Getting Started with MobileIron Core
11.0.0.0

December 3, 2020
For complete product documentation see:
MobileIron Core product documentation home page

Proprietary and Confidential | Do Not DistributeCopyright © 2009 - 2020 MobileIron, Inc. All Rights Reserved.
Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication
is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication. For some phone
images, a third-party database and image library, Copyright © 2007-2009 Aeleeta's Art and Design Studio, is used.
This database and image library cannot be distributed separate from the MobileIron product.
“MobileIron,” the MobileIron logos and other trade names, trademarks or service marks of MobileIron, Inc.
appearing in this documentation are the property of MobileIron, Inc. This documentation contains additional trade
names, trademarks and service marks of others, which are the property of their respective owners. We do notintend our use or display of other companies’ trade names, trademarks or service marks to imply a relationshipwith, or endorsement or sponsorship of us by, these other companies.

Getting Started with MobileIron Core 11.0.0.0| 2

Contents
New features and enhancements

10

General features and enhancements

10

Android features and enhancements

10

MobileIron Core Introduction

11

MobileIron Core overview

11

What can you do with MobileIron Core?

12

MobileIron Core components

12

Admin Portal

12

System Manager

12Enterprise Connector

13

CLI

13

MobileIron Core APIs

13

Documentation resources

13

Prerequisites for using this guide14

Getting Started Using MobileIron Core
MobileIron Core administrator tools overview

15
15

Admin Portal

15

System Manager

15

Admin Portal and System Manager credentials

16

Logging in to the Admin Portal with user name and password

16

Logging in to the Admin Portal with a smart card17

Setup tasks

17

Setting the enterprise name18

Setting the external hostname

18

Setting the idle timeout for the Admin Portal and user portal

19

Setting the idle timeout for CLI and SSH sessions

19

Warning period details

19

Getting Started with MobileIron Core 11.0.0.0| 3

Setting the EULA or other login text

20

Enabling last login information display

21

Enabling Notes for Audit Logs

21

Trusted certificates management

23

Configuring trusted certificate settings

24

Managing trusted certificates

25

Importing untrusted certificates

26

Managing Mobile Device Management (MDM) certificates for iOS and macOS

27

Requesting an MDM certificate

27

Uploading your MDM certificate

28

Enabling iOS MDM support

28

Confirming MDM for a macOS or iOS device

29

Denying check-Ins for devices having expired MDM certificates29

Displaying a report of devices having expired MDM certificates

29

Setting a System Event to be notified about certificate expiration

30

Renewing your MDM certificate

30

Admin Portal workspace

31

Dashboard workspace

31

Customizable banner

33

Action menus workspace

33

Sub-level action menu items

34

The Ideas Portal

37

Managing Users

38

User management overview

38

Types of users

38

The misystem user

39

Local users created during setup

39

Users and roles

39

User roles and LDAP groups

40

Getting Started with MobileIron Core 11.0.0.0| 4

Enforce Single Session role and concurrent session control

40

Accessing the user management page41

Configuring LDAP servers

41

LDAP Server window

43

Changing the LDAP Server Sync Interval

44

Managing LDAP users

44

Configuring the set of LDAP groups

45

Displaying available LDAP users

45

Deleting LDAP entities without roles

46

Viewing LDAP user/group associations

47

Synchronizing with the LDAP server

47

Changing the LDAP Sync Interval

48

Suspending scheduled LDAP synchronization globally48

Resuming scheduled LDAP synchronization

49

Synchronizing your LDAP server manually49

Setting the LDAP sync discard option

49

When the LDAP sync declines

51

Impacts of Making LDAP Changes

52

Deleting LDAP data from the MobileIron Core database

52

Deleting LDAP users

53

Moving between the LDAP entity display and the local user view

53

Assigning and removing device user roles

53

Managing local users in the Admin Portal

55

Adding local users in the Admin Portal

55

Add New User window

56

Editing local users in the Admin Portal

57

Linking local users to LDAP users

58

Deleting local users in the Admin Portal

58

Forcing a password change for local users

59

Getting Started with MobileIron Core 11.0.0.0| 5

Local user password policy overview

59

Local user password complexity enforcement

60

Local user password strength enforcement

61

Setting the password policy for local users

61

Local user password complexity enforcement details

61

Local user password strength enforcement details

63

Local user password strength value descriptions

64

Managing Devices
Devices & Users pages
Access to Devices & Users pages
Displaying device assets

67
68
68
68

Configuring the Devices page display

69

Devices page information types

70

Alerts displayed in the Devices page71

Displaying more device and user information

73

Adding a comment to device details

75

Displaying log data for a selected device

75

Single device registration

75

Prerequisites for registering a single device

76

Registering a single device

76

Add Single Device window

77

Bulk device registration

79

Prerequisites for bulk device registration

79

Registering multiple devices

80

Bulk device registration CSV file requirements

81

Tracking registration status

84

Restricting the number of devices a user registers

85

Modifying the number of devices users can register
Restricting device registration by enrollment type85
85

Getting Started with MobileIron Core 11.0.0.0| 6

Registration considerations

86

Registration considerations: Android

86

Registration restrictions for Android

86

Registration considerations: iOS and macOS

88

Registration considerations: Windows

88

Using bulk enrollment for Android devices

90

Using Policies

92

Policy overview

93

Working with policies

93

Accessing the Policies page

94

Policy page table

94

Modifying an existing policy

95

Creating a custom policy

95

Prioritizing policies

96

Displaying custom policies for a selected label

97

Displaying custom policies for a selected user

97

Deleting a policy

97

Applying policies to labels

97

Removing policies from labels

98

Using default policies

98

Security policies

99

Privacy policies

115

Lockdown policies

120

General lockdown policy fields

121

When work profile accounts can be modified

123

Lockdown policy fields for Windows devices

124

Lockdown policy fields for all Android devices and Android enterprise devices

126

Lockdown policy fields for all Android enterprise devices

127

Lockdown policy fields for Android enterprise devices in Work Profile mode

130

Getting Started with MobileIron Core 11.0.0.0| 7

Lockdown policy fields for Android enterprise devices in Work Managed Device mode and Managed
Device with Work Profile mode132
Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device
mode

135

Lockdown policy fields for Samsung Knox Workspace (3.0) Android enterprise Managed Device withWork Profile mode
139
Lockdown policy fields for Android enterprise devices with Samsung Restrictions in Work Managed
Device mode and Managed Device with Work Profile mode
140
Lockdown policy fields for Samsung Knox devices in Device Admin mode

143

Sync policies

147

Managing Labels

152

Apply to Label152

Device label search

153

Using search for device labels

153

Remove from label

154

Applying a device to a label

155

Removing a device from label

155

Using search for device labels

155

Using labels to establish groups

156

Default labels

157

Filter and manual type labels

158

Creating labels158

Add label window

159

Editing Labels

160

Copying a label to a new label

161

Viewing devices currently associated with a label

162

Associating a filter with a label: dynamic labels

162

Example: Creating a label for devices by operator

162

Example: Creating a label for devices by LDAP group

162

Deleting labels

163

Searching for device labels

163

Getting Started with MobileIron Core 11.0.0.0| 8

Viewing label use

164

Calculating devices impacted by changing or removing labels

165

Setting the device impact threshold165

Responding to label action alerts

166

Creating a label based on custom LDAP user attributes

166

Using the Dashboard

168

Dashboard overview

168

Dashboard charts

168

Viewing the App Dashboard

170

Arranging the devices dashboard charts

170

Changing the charts included in the dashboard

170

Devices associated with chart sections in the devices dashboard

171

Displaying device lists from devices dashboard charts

171

Adding an app chart to the apps dashboard

172

Deleting an app chart

173

Getting Started with MobileIron Core 11.0.0.0| 9

1
New features and enhancements
This guide documents the following new features and enhancements.

General features and enhancementslView 100+ Win32 apps on Windows 10 devices: For Windows 10 devices with more than 100 Win32
apps, the App inventory is updated in the database. You can view this inventory in the Device Details >Apps page. For more information, see Privacy policies.

lNew options to restrict Device Registration: New options for device registration are provided that allow
administrators to restrict which devices can register with MobileIron Core. The restrictions are based on
the enrollment type and the options are available on the Admin Portal in Settings > Users & Devices >Device Registration.
For more information, see Restricting device registration by enrollment type.

Android features and enhancementsl

New warning banner added to Privacy Policy: For Android devices, in the default Privacy Policy,
administrators can add a warning banner that displays upon device reboot. This is helpful for companies
that require all approved mobile operating systems, such as Android 9.0, to be managed according to asecurity baseline / guidance. Device users will see the warning banner upon device reboot and will have toacknowledge it before continuing use of the device. For more information, see Privacy policies.

l

New field added to Privacy policies: In the Privacy policy, a new field has been added - Prompt User
to Enable Location Services if Wi-Fi/MTD configuration is pushed (Android enterprise.)
Administrators have the ability to prompt device users to enable the device's location setting. This setting
is useful if the device user resides in a country that has GDPR requirements. During the registration
process, the device user is prompted to enable the location setting. If the device user does not grant
permission, the configuration will fail. See Privacy policies.

Getting Started with MobileIron Core 11.0.0.0| 10

2MobileIron Core Introduction
The topics in this chapter include:lMobileIron Core overviewlWhat can you do with MobileIron Core?

l

MobileIron Core componentslDocumentation resourceslPrerequisites for using this guide

MobileIron Core overview
MobileIron Core brings together comprehensive security and Unified Endpoint Management (UEM) tools including:lmobile device management (MDM)lmobile application management (MAM)lmobile content management (MCM)

With MobileIron Core, you can securely manage the lifecycle of mobile devices and mobile applications, fromregistering a device with Core, to retiring the device from Core management. When using a Core managed device,device users can securely access corporate data, email, and mobile apps that you control and distribute usingCore.

FIGURE 1. MOBILEIRON PRODUCT OVERVIEW

Getting Started with MobileIron Core 11.0.0.0| 11

What can you do with MobileIron Core?

What can you do with MobileIron Core?
MobileIron Core allows you to:lConnect to backend services such as LDAP and leverage LDAP users for use in CorelRegister both company- and employee-owned devices to be managed by Corel

Configure and push to devices policies and settings such as VPN settings and security policieslSecurely synchronize data from backend systems such as corporate emaillDistribute, install, and manage both publicly available and in-house mobile appslLeverage existing platform-specific mobile device management protocols, such as iOS MDMlConfigure and push certificates to deviceslConfigure and enforce compliance rules to handle compromised or stolen devices

MobileIron Core components
The main components of MobileIron Core include:lAdmin PortallSystem ManagerlEnterprise Connector

l

CLI

l

MobileIron Core APIs

Admin Portal
The Admin Portal is a web-based administrator portal you use to configure, manage, maintain, and troubleshootusers, devices, apps, policies, settings, and labels. The Admin Portal is where you register devices, distributeapps, configure and push policies to devices, and view the status of your fleet of managed devices at a glance.
This getting started guide focuses on the Admin Portal, as this is where the majority of setup occurs.
After you have used this guide to get started, refer to the MobileIron Core Device Management Guide for each
operating system (Android, iOS, Windows) for more advanced device management topics.

System Manager
The System Manager is used to configure MobileIron Core, manage network settings, manage Core within yourinfrastructure, upgrade Core, troubleshoot and maintain Core itself.
For more information about the System Manager, refer to the MobileIron Core System Manager Guide.

Getting Started with MobileIron Core 11.0.0.0| 12

Enterprise Connector

Enterprise Connector
The Enterprise Connector is a component that connects MobileIron Core to corporate directories, such as
Microsoft Active Directory or LDAP, by means of secure HTTPS connections. Multiple connectors can be used for
scaling and redundancy purposes.
For more information about the Enterprise Connector, refer to the On-Premise Installation Guide for MobileIron
Core and Enterprise Connector.

CLI
The CLI, or command line interface, allows you to access certain MobileIron Core and System Manager functions
from the command line in a terminal window.
For more information about using the CLI, refer to the MobileIron Core Command Line Interface (CLI) Reference.

MobileIron Core APIs
Core supports a number of application program interfaces (APIs) described in the following guides:lMobileIron WebService API Guidel

MobileIron V2 API Guidel

MobileIron ServiceConnect API Guide

Documentation resources
The information in this guide is intended to help you get started using MobileIron Core quickly, explaining many ofthe most commonly used features. For information about more advanced features, please refer to other available
documentation.
l

MobileIron product documentation is available at the following locations:l

MobileIron Core and related product documentation in the Support Community:
https://community.mobileiron.com/welcomelSearch for additional MobileIron Core documentation on the Support Community, specifically, the Device
Management Guide for each platform.

Note The Following:l

MobileIron Support credentials are required to access documentation in the Support Community.

l

For information, see MobileIron Product Documentation.

Getting Started with MobileIron Core 11.0.0.0| 13

Prerequisites for using this guide

Prerequisites for using this guideAll steps and procedures in this document assume you have successfully installed MobileIron Core. If not, go to
the On-Premise Installation Guide for MobileIron Core, Sentry, and Enterprise Connector and complete theinstallation process before using this guide.
NOTE: Make sure you have configured networks and ports, as described in the On-Premise Installation
Guide for MobileIron Core and Enterprise Connector. If you did not configure networks and ports
during installation, you must do so in the System Manager. For more information, see “AccessControl Lists: Networks and Hosts” in the MobileIron Core System Manager Guide.

Getting Started with MobileIron Core 11.0.0.0| 14

3
Getting Started Using MobileIron Core
The topics in this chapter include:lMobileIron Core administrator tools overview

lLogging in to the Admin Portal with user name and passwordlLogging in to the Admin Portal with a smart cardlAdmin Portal workspacel

The Ideas Portall

Setup tasks

MobileIron Core administrator tools overview
After installing Core, administrators can access the following administrator tools:lAdmin PortallSystem Manager

Admin Portal
Use the Admin Portal to manage:l

Users, both local and LDAPl

Devices, both employee- and company-ownedllConfigurations, settings, and policies, such as security, privacy, and synchronization policies, Wi-Fi and
VPN settings, cellular connectivity and single-app mode policies
App distribution, including publicly available apps and apps developed n-house

The Admin Portal is installed as part of the system setup. Refer to the On-Premise Installation Guide for MobileIron
Core and Enterprise Connector for installation details.

System Manager
Use the System Manager for performing configuration tasks, such as:lManaging network settingslConfiguring security settingslManaging Core within your network infrastructure

Getting Started with MobileIron Core 11.0.0.0| 15

Admin Portal and System Manager credentialslUpgrading Corel

Troubleshooting and maintenance

Refer to your System Manager Guide for information on using the System Manager.

Admin Portal and System Manager credentials
During setup, two local users having the same credentials are created, one for the Admin Portal and one for the
System Manager. If you make changes to the roles or password for the Admin Portal user, the changes do notaffect the System Manager user.

Logging in to the Admin Portal with user name and password
The Admin Portal is installed as part of the system setup. Log in to the Admin Portal to manage users, devices,apps, and configurations, settings, and policies.
Refer to the On-Premise Installation Guide for installation details.
If supported by your system administrator, you can login to the Admin Portal with a user name and password. Referto the MobileIron Core System Manager Guide for information on setting up this authentication method.
Note The Following:lll

If you enter the wrong password five consecutive times, the user ID you entered will be locked out
temporarily. Wait 30 seconds and try again.
You can configure the time period before auto-lock by selecting Settings > Security > Password policy >Auto-Lock Time. The default period is 30 seconds.
You can configure the number of incorrect consecutive passwords entered before Core lock the user nameby selecting Settings > Security > Password policy > Number of failed attempts. The default number
is 5.

Procedure
1. Open a supported browser.
Refer to the latest release notes for information on supported and compatible browsers.
2. Enter the URL for the Admin Portal.
https://<fully_qualified_hostname>/mifs
3. Enter the user ID and password.
The user associated with the credentials you enter must have one or more roles that provide access to Admin
Portal actions. The ID and password are case sensitive.
NOTE: The Super Administrator created during installation is automatically assigned several roles thatenable Admin Portal actions.
4. Click SIGN IN.

Getting Started with MobileIron Core 11.0.0.0| 16

Logging in to the Admin Portal with a smart card

Related topics
Logging in to the Admin Portal with a smart card

Logging in to the Admin Portal with a smart card
The Admin Portal is installed as part of the system setup. Log in to the Admin Portal to manage users, devices,apps, and configurations, settings, and policies.
Refer to the On-Premise Installation Guide for installation details.
If supported by your system administrator, you can login to the Admin Portal on a desktop computer using an
identity certificate on a smart card. Refer to the MobileIron Core System Manager Guide for information on setting
up this authentication method.
NOTE: This authentication method is supported only on desktop computers. It is not supported on
mobile devices. Also, it is not supported with Firefox.
Procedure
1. Attach your smart card reader with your smart card to a USB port on the desktop computer.
If your computer has a built-in smart card reader, insert your smart card.
2. Go to the URL of the Admin Portal at https://<fully_qualified_hostname>/mifs.
3. If you are not logged in, select Sign In With Certificate.
A prompt appears to select your certificate.
4. Select the certificate from the smart card.
5. If prompted, enter the password of the private key of the identity certificate on your smart card. The Admin
Portal displays.
Related topics
Logging in to the Admin Portal with user name and password

Setup tasks
This section includes the following setup tasks:l

Setting the enterprise namelSetting the external hostnamelSetting the idle timeout for the Admin Portal and user portallSetting the EULA or other login textlEnabling last login information display

Getting Started with MobileIron Core 11.0.0.0| 17

Setting the enterprise namelEnabling Notes for Audit Logsl

Trusted certificates managementl

Uploading your MDM certificatelEnabling iOS MDM supportlRequesting an MDM certificatelConfirming MDM for a macOS or iOS devicel

Denying check-Ins for devices having expired MDM certificateslDisplaying a report of devices having expired MDM certificateslSetting a System Event to be notified about certificate expirationlRenewing your MDM certificate

Setting the enterprise name
The company name entered during MobileIron Core installation is used as the default enterprise name identifying
your organization in email, SMSes, alerts, and certificates. If the company name you entered is not the one youwant to use in these contexts, you can change the name.
NOTE: Be sure to set the enterprise name before you upload certificates, or you may impact all
registered devices.
Procedurel

Log into the Admin Portal.

l

Go to Settings > System Settings > General > Enterprise.

l

In the Enterprise Name field, enter the text to use when referring to the enterprise.

lClick Save.

Setting the external hostname
The external hostname is set during installation. It is used in the registration URL sent to users for completing theregistration process. It is also used in self-signed certificates.
Impact: Changing this field requires the following:llRegeneration of any self-signed certificates or uploading matching portal-HTTPS and client-TLS
certificates
Rebooting the appliance

Getting Started with MobileIron Core 11.0.0.0| 18

Setting the idle timeout for the Admin Portal and user portal

Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings > General > Enterprise.
3. In the External Host field, enter the fully-qualified domain name to be used for accessing MobileIron.
4. Click Save.

Setting the idle timeout for the Admin Portal and user portal
Based on your security requirements, you can decide how much idle time is allowed before an administrator or user
is automatically logged out of the Admin Portal or self-service user portal. You configure the idle session timeout in
the Admin Portal at Settings > System Settings > General > Timeout. You can choose an idle timeout between
5 and 90 minutes.
A pop-up warns the administrator or user about the impending timeout a few minutes before the configured idle time
elapses.

FIGURE 2. IDLE TIME OUT WINDOW

When the time elapses, the administrator or user is logged out. If the administrator or user clicks Extend session,
the timer is reset.
NOTE: Changing the idle timeout impacts all future logins. It does not impact your current session.

Setting the idle timeout for CLI and SSH sessions
You can set the idle timeout for command line interface (CLI) and secure shell (SSH) sessions in MobileIron
System Manager.
For details, refer to “System Settings” in the MobileIron Core System Manager Guide.

Warning period details
The pop-up that warns that the administrator or user will be logged out precedes the timeout as follows:

Getting Started with MobileIron Core 11.0.0.0| 19

Setting the EULA or other login text

TABLE 1. ADD VLAN FIELDS
Configured idle timeout

Pop-up warning appearance

5 to 35 minutes

3 minutes before timeout

40 or 45 minutes

4 minutes before timeout

50 or 55 minutes

5 minutes before timeout

60 or 65 minutes

6 minutes before timeout

70 or 75 minutes

7 minutes before timeout

80 or 85 minutes

8 minutes before timeout

90 minutes

9 minutes before timeout

Setting the EULA or other login text
You can configure MobileIron Core to display an End User License Agreement (EULA) or any other text on thefollowing:lAdmin Portal login screenlSystem Manager login screenla CLI sessionlself-service user portal login screen

Procedure
1. In the Admin Portal, go to Settings > System Settings > General > Login.
2. Select Enable Login Text Box.
3. In Text To Display, enter the text.
NOTE: Core treats the text as plain characters. It does not recognize, for example, HTML tags.
The text must be ASCII only; no multi-byte characters are allowed.
4. Click Save.
The Admin Portal and the System Manager display this text the next time a user logs in.
NOTE: The MobileIron Core CLI command banner, available in CLI CONFIG mode, also sets thistext.
To disable this setting:
1. In the Admin Portal, go to Settings > System Settings > General > Login.
2. Uncheck Enable Login Text Box.
The text you had entered in Text To Display is grayed out.
3. Click Save.

Getting Started with MobileIron Core 11.0.0.0| 20

Enabling last login information display

The login screens and CLI session do not show the text the next time a user logs in.

Enabling last login information display
You can enable a setting to show the current Admin Portal user some login information about the last login to the
Admin Portal. This information provides you security insight about Admin Portal use. The information displays
when you click on the user icon at the top right of the screen. An example of the information is:
Last login was 3/11/2014 1:28:52 PM from 171.15.10.221

The information includes:lthe date of the last loginlthe time of the last loginlthe IP address of the computer that was used for the last login

To configure this setting:
1. In the Admin Portal, go to Settings > System Settings > General > Login.
2. Select Always Show Last Login.
3. Click Save.
The Admin Portal displays the last login information the next time a user logs in.

Enabling Notes for Audit Logs
As a best practice, MobileIron recommends enabling Notes for Audit Logs. This is used for tracking changes tolabels made by administrators. By default, this feature is disabled. When enabled, administrators will be promptedwith a text box similar to the one below.

Getting Started with MobileIron Core 11.0.0.0| 21

Enabling Notes for Audit Logs

For example, an administrator can enter a change ticket order number, thus allowing for automated monitoring of
the MobileIron Core environment. This information is then displayed in the Audit logs, in the Details column as"Reason."Notes for Audit Logs is applicable for the following label-related activities:l

Add/Edit/Delete/Save Label (Both filter and manual)l

In the Devices & Users > Devices > Advanced Search > Save to Labell

Add/Edit/Remove Label to devicesl

Add/Edit/Remove Label to configurationsl

Add/Edit/Remove Label to policiesl

Add/Edit/Remove Label to appsl

Add/Edit/Remove Label to iBooks

Using this feature, you can also track administrator-made changes to iOS and macOS restrictions. Whenever anadministrator adds, edits or deletes iOS and macOS restriction(s), a text dialog box displays for the administrator toenter a reason for the change. For more information about restrictions, see the MobileIron Core Device
Management Guide.
Procedure
To set the tracking of changes made by administrators:
1. Go to Settings > System Settings.
2. In the left pane, click General > Notes for Audit Logs. The Notes for Audit Logs page displays.

Getting Started with MobileIron Core 11.0.0.0| 22

Trusted certificates management

3. Select Enable Notes for Audit Logs and then click Save.

Trusted certificates management
MobileIron Core uses TLS/SSL to secure incoming and outgoing connections to outside entities, such as servers,clients, and Sentry. Clients connecting to a server over TLS/SSL are required to verify the server certificate chain
obtained during the TLS/SSL handshake. To ensure these connections are secure, MobileIron verifies thecertificate chain and server hostname, and checks the certificate against the Certification Revocation List (CRL).
The Trusted Certificates feature provides administrators with the ability to:
l

l

l

l

Check the CRL: This ensures that verification information is current by checking certificates (trusted andnew) against obtained CRLs. Certificate validity periods are checked against the current time provided by
the verifier's system clock.
Verify signatures: These are verified using the public key in the issuer's certificates.
Verify the certificate chain: This ensures the certificate chain is well-formed, valid, properly signed, andtrustworthy. Certificate chain verification stops at trusted anchor certificate stored by MobileIron.
Verify server hostname: This verifies the server's hostname against names included in server certificate.

The trusted certificate feature has the following settings:lll

Allow only TLS/SSL connections certified by trusted CAs: This setting provides the highest level of
security using the TLS/SSL protocol. Administrators manually enable the configuration of trusted
certificates with additional preferences for server hostname verification and revocation status validation
based on the Certification Revocation List (CRL).
Allow all TLS/SSL connections and register certifying CAs as trusted: This setting adds allconnections to the Show Trusted Certs table. This action creates a migration path where administrators
can review details of each certificate and manually turn on TLS/SSL over time.
Allow all TLS/SSL connections: This is the default setting and allows all outgoing connections after
verifying the Issuer, Subject, Signature, and Validity status.

Getting Started with MobileIron Core 11.0.0.0| 23

Configuring trusted certificate settings

Configuring trusted certificate settings
MobileIron Core allows you to configure any of the following trusted certificate settings:lll

Allow only TLS/SSL connections certified by trusted CAs. This setting allows administrators tomanually configure trusted certificates and allows them to disable the server hostname and revocation
status verification. Revocation status validation is based on Certification Revocation List (CRL) that areautomatically downloaded and verified. The CRL grace period is configurable with a default value of 30
minutes.
Allow all TLS/SSL connections and register certifying CAs as trusted. This setting automaticallyadds all required certificates to the trusted certificate table available for review in the Admin Portal. This
allows administrators to turn on TLS/SSL instantly.
Allow all TLS/SSL connections. This setting allows all outgoing connections, providing basic certificate
chain verification including certificate names, signatures, and validity.

NOTE: Switching among these TLS/SSL settings requires you to restart MobileIron Core for your changes
to take effect.
Procedure
1. From the Admin Portal, go to Settings > System Settings > Security > TLS/SSL to open the trusted
certificate settings window.

2. Select one of the following settings.
a. Allow only TLS/SSL connections certified by trusted CAs. This setting allows administrators tomanually configure trusted certificates and allows them to disable the server hostname and revocation
status verification. Revocation status validation is based on Certification Revocation List (CRL) that

Getting Started with MobileIron Core 11.0.0.0| 24

Managing trusted certificatesare automatically downloaded and verified. The CRL grace period is configurable with a default valueof 30 minutes.
b. Allow all TLS/SSL connections and register certifying CAs as trusted. This setting
automatically adds all required certificates to the trusted certificate table available for review in the
Admin Portal. This allows administrators to turn on TLS/SSL instantly.
c. Allow all TLS/SSL connections. This setting allows all outgoing connections, providing basic
certificate chain verification including certificate names, signatures, and validity.
3. Click Save.

Managing trusted certificates
Depending on how trusted certificates are configured, MobileIron Core adds trusted and untrusted root certificatesto the Admin Portal. The procedures in this section describe how to manage the information in these tables.
This section contains the following procedures:lDelete a certificate.

l

Trust an untrusted certificate.

l

Add a trusted certificate.

lView certificate details.

To delete a certificate:
1. From the Admin Portal, go to Services > Trusted Root Certificates.
2. Click the drop down box to the right and select one of the following options:a. Show Trusted Certs
b. Show Untrusted Certs
3. Select one or more certificates.
4. Select Actions > Delete.
5. Click Yes in the confirmation box.
IMPORTANT: You must restart the server to complete the process of deleting the selected trusted
certificates.
To trust an untrusted certificate:l

Log into the Admin Portal and select Services > Trusted Root Certificates.

lClick the drop down box and select Show Untrusted Certs.

lClick the View Certificate link for the certificate you want to trust.
You can select only one certificate at a time to allow you to review each certificate individually.

l

Review the certificate information and click Close when you have completed the review.

lSelect Actions > Trust.

Getting Started with MobileIron Core 11.0.0.0| 25

Importing untrusted certificatesl

Review the trust certificate.

l

Click Trust if you want to continue or Cancel.

To add a trusted certificate:l

Log into the Admin Portal and select Services > Trusted Root Certificates.

lClick the drop down box and select Show Trusted Certs.

lClick the Add+ button to open the Upload Trust Root Certificate dialog.

l

Add the certificate to the File box using the Browse button.

l

Click Upload Certificate to add it to the list of trusted certificates.

lClick OK.

To view certificate details:
1. Log into the Admin Portal and select Services > Trusted Root Certificates.
2. Click the drop down box to the right and select one of the following options:a. Show Trusted Certs
b. Show Untrusted Certs
3. Click the View Certificate link for a single certificate.
4. View the certificate details, then click Close.

Importing untrusted certificates
MobileIron Core fails to connect to a service if both of the following are true:ll

On Settings > Security > TLS/SSL, you have selected Allow only TLS/SSL connections certified bytrusted CAs.
MobileIron Core does not trust at least one Certificate Authority (CA) in the certificate chain that theservice presents to Core.

This failure can occur for:lServices listed on Services > Overview.

lAdditional services you use, such certificate providers configured in certificate enrollment settings.

On a new Core installation, to simplify the process to trust the services listed on Services > Overview, MobileIron
recommends the following procedure:
Procedure
1. On Settings > Security > TLS/SSL, select Allow all TLS/SSL connections and register certifying
CAs as trusted.
2. Verify your connections with the backend services by selecting Verify All in Services > Overview.

Getting Started with MobileIron Core 11.0.0.0| 26

Managing Mobile Device Management (MDM) certificates for iOS and macOS

Core imports the certificate chains, which will now appear in Services > Trusted Root Certificates.
3. On Settings > Security > TLS/SSL, select Allow only TLS/SSL connections certified by trusted
CAs.
4. To trust additional certificates, follow the procedure in Managing trusted certificates.

Managing Mobile Device Management (MDM) certificates for iOS and macOS
This section includes the following topics:lRequesting an MDM certificatelUploading your MDM certificatelEnabling iOS MDM supportlConfirming MDM for a macOS or iOS devicel

Denying check-Ins for devices having expired MDM certificateslDisplaying a report of devices having expired MDM certificatesIf you are using only MAM-only iOS devices, skip these MDM-related sections. For more information, see“Managing apps on MAM-only devices” in the MobileIron Core Apps@Work Guide.

Requesting an MDM certificate
You can request an MDM certificate from Apple.
Before you begin
When using the option Allow only TLS/SSL connections certified by trusted CAs as selected in Configuring
trusted certificate settings, make sure that all certificates listed in Services > Trusted Root Certificates aretrusted. To trust certificates, see Managing trusted certificates.
Procedure
1. Log into the Admin Portal and select Settings > System Settings.
2. Select iOS > MDM.
3. Select the Enable MDM Profile option.
4. Click Install MDM Certificate.
The MDM Certificate Generation window displays.
5. Click Download Certificate Signing Request.
If an empty text file downloads, see the steps in Before you begin.
Otherwise, this step generates the required property list in Apple’s .PLIST XML format.
This may take a few minutes.
6. Select a location for the plist when prompted.

Getting Started with MobileIron Core 11.0.0.0| 27

Uploading your MDM certificate

The downloaded file is req-plist.txt .
7. Click the Apple Push Certificates Portal link to start the process of requesting the MDM certificate.
8. When you receive the MDM certificate from Apple, click Upload MDM Certificate. The Upload MDM
Certificate dialog appears.
9. Click Browse to select the MDM certificate.
10. Click Upload Certificate.

Uploading your MDM certificate
If you have already requested and received your MDM certificate from Apple, you can upload the certificate using
the following steps:
Procedure
1. Log into the Admin Portal.
2. Go to Settings > System Settings.
3. Select iOS > MDM.
4. Select the Enable MDM Profile option.
5. Click Install MDM Certificate to open the MDM Certificate Generation dialog.
6. Select I already have an MDM Certificate, and want to upload it.

7. Click Display Upload Certificate Form to open the Upload MDM Certificate dialog.
8. Click Choose File to select the MDM certificate.
9. Click Upload Certificate.

Enabling iOS MDM support
Once you have completed all steps required by Apple, you can enable iOS MDM support in MobileIron. See thefollowing source for information on Apple’s current program:
http://www.apple.com/ipad/business/integration/mdm/

Getting Started with MobileIron Core 11.0.0.0| 28

Confirming MDM for a macOS or iOS device

MobileIron uses Apple’s enhanced MDM certificate infrastructure to streamline the process of acquiring anduploading an MDM certificate. You can now complete the following tasks from a single screen within the Admin
Portal:l

generate a Certificate Signing Request (CSR)lupload the CSRlaccess the Apple Push Certificates Portal to request a certificatelupload the MDM certificate

If you already have an MDM certificate, but have not uploaded it, you can upload it from the same screen.
If you enabled iOS MDM support in a previous MobileIron release, then you should not use the enhanced certificate
infrastructure at this time unless otherwise instructed by Apple or MobileIron. Doing so will disable your current
certificates for all registered Mac iOS devices.
NOTE: If you intend to develop in-house apps for distribution, then you still need to participate in Apple
Device Enrollment. For more information about participating in Apple Device Enrollment, see“Managing Devices Enrolled in the Apple Device Enrollment Program” in the MobileIron Core
Device Management Guide for iOS Devices.

Confirming MDM for a macOS or iOS device
To confirm that MDM is operational for a macOS an iOS device:
Procedure
1. Log into the Admin Portal and select Device & Users > Devices.
2. Select any iOS device and click the up arrow to expand the device details.
3. In the Device Details tab, confirm that the MDM Operational flag value is Yes.

Denying check-Ins for devices having expired MDM certificates
By default, MobileIron Core allows macOS and iOS devices with expired MDM certificates to check in. You can,however, configure Core to deny check-ins to these devices.
Procedure
1. Log into the Admin Portal and select Settings > System Settings.
2. Select iOS > MDM.
3. In the MDM Preferences section, clear the Permit expired client certificate option.
4. Click Save.

Displaying a report of devices having expired MDM certificates
You can save to a CSV file a list of the iOS or macOS devices with expired MDM certificates.
Getting Started with MobileIron Core 11.0.0.0| 29

Setting a System Event to be notified about certificate expiration

Procedure
1. Log into the Admin Portal and select Settings > System Settings.
2. Select iOS > MDM.
3. Click Download Expired MDM Certificate Devices Report.
4. Open or save the resulting CSV file.

Setting a System Event to be notified about certificate expiration
You can be notified of the pending expiration of your iOS MDM certificate 30 days before its expiry.
Procedure
1. Log into the Admin Portal and select Logs > Event Settings.
2. Click Add New > System Event.
3. Enter a name for the System Event.
4. Make sure Certificate Expired is selected. Select other options according to your requirements.
5. In the Send Alerts section, under Apply to Labels, do not select a label.
6. In the Search Users field, enter the user ID of an administrator who has a device registered on
MobileIron Core.
7. Select the administrator in the Apply to Users list.
8. Click the right arrow to move the administrator to the Selected list.
9. Click Save.
Related topics"System event settings" in the MobileIron Core Device Management Guide for iOS and macOS Devices.

Renewing your MDM certificate
Renew your MDM certificate before it expires. This procedure uses the MobileIron Core Admin Portal and theApple Push Certificates Portal. You need the Apple ID that was originally used to create the MDM certificate. If you
don't know what Apple ID to use, open a ticket with Apple Developer Program Support.
Note The Following:l

Do not use Internet Explorer for this procedure.

lApple might change the steps involving the Apple Push Certificates Portal.

Procedure
1. Log into the Core Admin Portal and select Settings > System Settings.
2. Select iOS > MDM.

Getting Started with MobileIron Core 11.0.0.0| 30

Admin Portal workspace

3. Click Install MDM Certificate.
4. Click Download Certificate Signing Request.
5. Note to where the file is downloaded.
6. Click Apple Push Certificates Portal.
7. Log in to the Apple Push Certificates Portal using the same Apple ID that was used to create thecertificate.
8. In the Apple Push Certificates Portal, you will see your MDM certificate.
9. Click Renew.
10. Click Choose File and find the txt file that you downloaded.
11. Click Upload.
12. When you see the confirmation screen, click Download.
The renewed certificate, a PEM file, downloads.
13. In the Core Admin Portal, in the MDM Certificate Generation screen, click Upload MDM Certificate.
14. Browse to the PEM file and click Upload Certificate.
A confirmation screen displays.
15. Click the X to close the confirmation screen.
16. Click View Certificate to note the new date and time on the certificate.
Related topics
How To Identify a Matching MDM Cert in the Apple Push Certificate Portal

Admin Portal workspace
The Admin Portal provides the following types of workspaces:llDashboard: the first page open each time you log into the Admin Portal gives you an at-a-glance view of
the all managed devices.
Action menus: includes all the top-level menus that help you manage devices.

NOTE: Do not create bookmarks for Admin Portal pages. Session IDs are included in the bookmark andmay cause connection problems. If you would like to create a bookmark for the Admin Portal,
create one manually for the following URL: https://<fully_qualified_hostname>/mifs.

Dashboard workspace
Core opens the Dashboard each time you log into the Admin Portal. The Dashboard workspace has the following
components (the numbers displayed in Dashboard workspace correspond to the numbers listed in Admin Portal
menu items ).

Getting Started with MobileIron Core 11.0.0.0| 31

Dashboard workspace

FIGURE 3. DASHBOARD WORKSPACETABLE 2. ADMIN PORTAL MENU ITEMS
NumberElement

Description

1

User Icon

Opens the drop down MobileIron information (2).

2

MobileIron
information

Displays:l

Username logged into the Admin Portal (User1, for example)lSystem Manager links to System Managerl3Main menu

Help links to the MobileIron support website. You will needcredentials to access the MobileIron support website.

lAbout provides MobileIron Core version informationlSubmit an Idea opens The Ideas Portal.

l

Sign Out logs you out of the Admin Portal

The main navigation menu options (Dashboard, Devices & Users,
Admin, Apps, Policies & Configs, Services, Settings, Logs)

4

Dashboard widgets

One of the many device management widgets available on the
Dashboard.

Getting Started with MobileIron Core 11.0.0.0| 32

Customizable banner

Customizable banner
As a convenience, you can set your Core to indicate to IT administrators what environment they are in whenlogging to the Core user interface console, for example: Production, Sandbox or Dev. This is done with an editable
field that takes up to 35 characters and displays in the top-left corner of the Admin portal, under the MobileIron Core
logo.

Administrators with "Manage settings and services" or "View settings and services" or "Manage custom attributes
role" privileges have access to creating or editing this customized banner.
Procedure
1. Go to Settings > System Settings.
2. Under General, select Enterprise.
3. In the Deployment section, enter a name that will appear under the MobileIron Core logo in the left corner ofthe Admin portal.
4. When finished, click Save.
5. Refresh your browser. The new name displays.

Action menus workspace
Click any of the top-level action menus (Devices & Users, Admin, Apps, Policies & Configs, Services, Settings,
Logs) to expand the Admin Portal workspace to take action on managing Core. Action menu workspaces have thefollowing components (the numbers displayed in Action menu workspace correspond to the numbers listed in
Action menu workspace items ).

Getting Started with MobileIron Core 11.0.0.0| 33

Sub-level action menu items

FIGURE 4. ACTION MENU WORKSPACE

The following table describes the elements in the action menus of the Admin Portal.

TABLE 3. ACTION MENU WORKSPACE ITEMS
NumberElement

Description

1

Main menus

The top-level action menus (Devices & Users, Admin, Apps, Policies & Configs,
Services, Settings, Logs).

2

Menu items

Displays the sub-level menu items for the main menu.

3

Page leveltask bar

Includes the set of actions you can take on each record displayed on the page.

4

User icon

The user icon logged into the Admin Portal.

5

Page

Displays all records for the menu.

Sub-level action menu items
The following table describes the secondary sub-level menu items for action menus in the Admin Portal.

Getting Started with MobileIron Core 11.0.0.0| 34

Sub-level action menu items

TABLE 4. SUB-LEVEL MENU ITEMS
Actionmenu

Sub-level menu items

Actions

Devices& Users

DevicesManage devices by adding, retiring, viewing details.
You can also take actions such as lock, send messages, set custom
attributes, add devices to labels.

Users

Manage users by adding, deleting, viewing details.
You can also take actions such as assign roles, set custom attributes,
require password changes, delete

Admin

Apps*

LabelsManage labels by adding, editing, viewing details.

ActiveSync

Displays and registers devices accessing ActiveSync. This view ispopulated only if you have a MobileIron Sentry configured.

Apple DEP

Specifies an Apple Device Enrollment account for use with MobileIron
Core

Apple Education

Manage Apple School Manager devices using Core as the designatedMobile Device Management (MDM) server.

AdminsManage admins by editing roles, assigning or removing from a space.

Device Spaces

Create or manage device spaces.

App Catalog

Add apps from iTunes, Google Play, Windows Store, In-House apps,
and Web Applications.

iBooksManage Apple iBooks.

Installed Apps

Manage installed apps.

App Tunnels

Manage registered and unregistered app tunnels.

App Control

App Control enables you to:llspecify app control rules, including white list, black list, andrequired apps
identify devices that are out of compliance with app control
rules.

Apps@Work Settings

Create store-front branding for Apps@Work.

App Licenses

Manage the Apple licenses.

Getting Started with MobileIron Core 11.0.0.0| 35

Sub-level action menu items

TABLE 4. SUB-LEVEL MENU ITEMS (CONT.)
Actionmenu

Sub-level menu items

Actions

Policies&
Configs

Configurations

Manage, import, and export configurations.

Policies

Manage policies.

ActiveSync Policies

Manage ActiveSync policies for devices that connect to the enterpriseusing ActiveSync.

Compliance Policies

Customize compliance policy rules.

Compliance Actions

Manage default and custom compliance actions for policies.

Access

Add and manage MobileIron Access as a service. MobileIron Access isa cloud service that secures access to enterprise content in businesscloud services such as Office 365, G Suite, Salesforce, Box, andDropbox.

Services

For information about MobileIron Access as a service and how to set up
the service with MobileIron Core, see the MobileIron Access Guide.
SentryAdd and manage Sentry.
For information about Sentry and how to setup the service with
MobileIron Core, see the MobileIron Sentry Guide

Connector

Add and manage Connector.

LDAP

Add and manage LDAP.

GoogleAdd and manage Google account.

Operators

Add and manage Operators.

LDAP

Add and manage LDAP.

Local CA

Add and manage local CA.

Trusted Root
Certificate

Add and manage trusted root certificates.

Samsung

Samsung Firmware E-FOTA License Management.

Getting Started with MobileIron Core 11.0.0.0| 36

The Ideas Portal

TABLE 4. SUB-LEVEL MENU ITEMS (CONT.)
Actionmenu

Sub-level menu items

Actions

Settings

System Settings

Manage settings for General, Security, Users & Devices, iOS, Android,
Windows, Licensed Products, and App Reputation.
Actions you can take include, setting up alerts, outbound HTTP,
registration, MDM for iOS devices, SMS & Call Log archives forAndroid devices, setting up the Business Store Portal for Windows
devices.

Logs

Templates

Manage templates such as registration and event center templates.

Audit Logs, MDM
Activity, Certificate
Management, Even
Settings, Events

Use these options for troubleshooting.

*Refer to the MobileIron Core Apps@Work Guide for more information on managing apps.

The Ideas Portal
The Ideas Portal is the place to add your enhancement and new feature suggestions for MobileIron products.
NOTE: To access the Ideas Portal, you must have an account with MobileIron Support, and must also
have the credentials to access that account. For more information, contact your MobileIron
representative.
To submit an enhancement or new feature idea to the Ideas Portal:
Procedure
1. From the Admin Portal, click the user icon at the top of the Admin Portal to open the MobileIron informationmenu.
2. Click Submit an Idea to be redirected to the MobileIron support site.
3. Enter your MobileIron Support account credentials.
4. Select the Ideas tab.
If you do not have an Ideas tab, click the plus sign at the end of the displayed tabs. Select Ideas from the
All Tabs list to access the Ideas tab.
5. Fill in the form with the information for your enhancement or new feature idea.
6. Click Submit Idea.

Getting Started with MobileIron Core 11.0.0.0| 37

4Managing Users
The topics in this chapter include:lUser management overviewlConfiguring LDAP serverslManaging LDAP usersl

Assigning and removing device user roleslManaging local users in the Admin PortallLocal user password policy overview

lSetting the password policy for local usersl

Local user password complexity enforcement detailslLocal user password strength enforcement details

User management overview
This chapter explains how to manage local and LDAP users for Admin Portal. For information on managing local
users in System Manager, refer to MobileIron Core System Manager Guide.
The main topics in this overview include:lTypes of usersl

The misystem userl

Local users created during setupl

Users and rolesl

User roles and LDAP groupsl

Enforce Single Session role and concurrent session control

Types of users
MobileIron Core supports local users and LDAP users.
l

LDAP users are imported from your organization’s LDAP server.
In most cases, you will configure an LDAP server and import LDAP users.

l

Local users are entities created in the local MobileIron database. They are not known to the network orother corporate services.

Getting Started with MobileIron Core 11.0.0.0| 38

The misystem user

Local users are best for the following scenarios:-

administration
testing

Local users created in the Admin Portal can be used for registering devices and accessing the Admin Portal
and the user portal. Local users created in the System Manager can be used in the System Manager and the
CLI.

The misystem user
The misystem user is a default MobileIron Core user used for the following tasks:lcreates the default rules and policieslexecutes system maintenance tasks

This user is not listed in the Admin Portal, and it has no roles assigned to it.

Local users created during setup
The local user you define during setup actually results in two local users, one in the Admin Portal and one in the
System Manager.

FIGURE 5. LOCAL USERS CREATED DURING SETUP

Though these two users start with the same name and password, they are separate users stored in separate
databases. Changes made to one do not affect the other. For example, if you change the password for the Admin
Portal user, the password for the System Manager user does not change.

Users and rolesl

You work with the following basic user and administrator types in the Admin Portal:l

Device users: end users who use the managed devices (owned by themselves or the enterprise).

lSuper Administrators: manage devices and users throughout MobileIron Core. These administrators are
assigned to the global space. The role that these administrators have that set them apart is Manage
administrators and device spaces. Only administrators with this role can create and manage device

Getting Started with MobileIron Core 11.0.0.0| 39

User roles and LDAP groups

spaces and assign roles and device spaces to administrators. MobileIron Core can have one or more
Super Administrators.
lGlobal Administrators: manage devices throughout MobileIron Core. These administrators are assigned
to the global space and can be assigned any roles other than Manage administrators and device spaces.
NOTE: In order for users with global space permissions to see the App tab in the Dashboard, theyneed to be granted View App Dashboard permissions. See Viewing the App Dashboard.

lDevice Space Administrators: manage only the devices and users assigned to the device spaces towhich they are assigned. For example, an administrator assigned to the Dallas Help Desk device spacecan only manage devices assigned to that device space. The roles that can be assigned to Device Space
Administrators are limited. For example, Device Space Administrators, if assigned the correct role, canview configurations or apply and remove configurations from a label. However, they cannot create or edit
configurations.

User roles and LDAP groups
In a large organization, assigning roles to individual users can be cumbersome. Instead, you can assign roles to
LDAP groups or organizational units. By assigning roles to an LDAP group or organizational unit, you apply a givenrole to all the members of the group or organization unit at once.

Enforce Single Session role and concurrent session control
Concurrent session control is applied to administrators by assigning them the Enforce Single Session role. The
concurrent session control feature automatically logs off a MobileIron Core session if the administrator has logged
in on another machine or browser.
NOTE: An administrator can use multiple tabs of a single browser without being logged off. An
administrator can also use multiple windows of the same browser on the same machine without
being logged off.
To enable concurrent session control:
Procedure
1. From the Admin Portal, go to Admin > Admins.
2. Select an administrator.
3. Go to Actions > Edit Roles.
4. Select Enforce Single Session.
5. Click Save.
The role appears as Enforce single session (all spaces) in the list of roles for the administrator.

Getting Started with MobileIron Core 11.0.0.0| 40

Accessing the user management page

Accessing the user management page
The Manage user role is required for access to the user management screen. See Assigning and removing deviceuser roles for more information.
By default, the user management screen displays the Authorized Users view. This view includes LDAP and local
users. Select LDAP Entities from the To drop-down list to display only LDAP entities.
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users.
3. Click Users to display the user management screen.

Configuring LDAP servers
When configured, MobileIron can interact with LDAP servers. You can configure multiple LDAP servers, but eachserver must contain unique configuration.
NOTE: The MobileIron Connector does not support certificate-based authentication. This means thatonce you enable Connector service, the "Upload X509 Certificate" option in LDAP preferences is
not available.
Procedure
1. From the Admin Portal, go to Services > LDAP.
2. Click Add New to open the New LDAP Setting page.
3. Edit the fields as necessary.
Refer to the LDAP Server window table for details.
4. Scroll to the LDAP Groups setting to specify the set of LDAP groups that Core gets from the LDAP
server. Only these groups are available throughout the Admin Portal for viewing or selection.
5. Go to Search By LDAP Groups, enter the first characters of an LDAP Group that you want to select.
6. Click the search icon.
The LDAP Groups in the LDAP server that match the search request appear in the Available section.
7. Click the right arrow to move one or more LDAP groups to the Selected section.
8. Repeat steps 6 through 8 for other LDAP Groups.
9. Click Advance Options to configure LDAP v3 properties.
NOTE: Configurations in the Advanced Options pane apply only to LDAP v3 servers.
10. Select the authentication method between the client and server used in the SASL exchange.

Getting Started with MobileIron Core 11.0.0.0| 41

Configuring LDAP serverslBind (default): This method uses the directory DN for authentication.

lKerberos v5 (SASL): This method uses mutual authentication.

11. Select the user ID format from the Authentication User ID Format drop-down list.
lUser PrincipallUser UPNl

User DNl

User DN with RFC2829 prefixlUser Principal with RFC2829 prefix

12. Select the group member format from the Group Member Format drop-down list.
l

DN

l

UID

13. Select the parameter for negotiating the authentication from the Quality of Protection drop-down list.
NOTE: LDAP v3 supports the Quality of Protection feature, which is not a LDAP v2 supported
feature.
lllAuthentication only is used for authenticating a user to a server.
Authentication with integrity protection is used to ensure that subsequent LDAP requests andresponses are protected against tampering.
Authentication with integrity and privacy protection is used to ensure that subsequent LDAP requests
and responses are encrypted and therefore protected against unintended monitoring. Privacy
protection automatically entails integrity protection.

14. Select the LDAP authentication method.
lll

Use Client TLS Certificate: Select this to use the X509 certificate for authentication.
Go to Services > LDAP > Preferences to upload the client X509 certificate that MobileIron Core
presents to the LDAP server
Request Mutual Authentication: Select this to verify both the identity of the user that is requestingauthentication as well as server providing the requested authentication.

15. Select Enable Detailed Debug to enable JNDI debugging for LDAP communication.
16. Enter additional (and optional) properties in the Additional JNDI Context Properties field.
17. Most environment properties are predefined but some, such as language, security.credentials,
security.principle, are implementation-specific. Properties defined here replace any values that arepreviously defined, and will take effect the next time the property is invoked. If a context does not have aparticular environment property, it behaves as if it has that environment property with its default value. For
example,ll

To set the language for Japanese, enter Context.LANGUAGE, “ja-JP”
To set the credentials to the string "secret", enter Context.SECURITY_CREDENTIALS,"secret"Getting Started with MobileIron Core 11.0.0.0| 42

LDAP Server windowl

To set the principal name to the distinguished name "cn=admin, o=MI, c=us," enter
Context.SECURITY_PRINCIPAL, "cn=admin, o=MI, c=us"

18. Click View LDAP Browser to view the LDAP server directory tree structure.
19. Click Test to open the LDAP Test window
20. Enter user or group identifier in the appropriate field.
21. Click Submit. A result page displays if the user was configured on the LDAP server.
22. Return to the LDAP page and click Save. A dialog appears informing of traffic disruption and asks toproceed.
23. Click Yes. A dialog appears informing the status.
24. Click OK. The server you created appears on the LDAP page.

LDAP Server window
The following table summarizes fields and descriptions in the LDAP Server window:

TABLE 5. LDAP SERVER FIELDS
FieldsDescription

Directory URL

Enter the URL to the LDAP server. Make sure to start with “ldap://” or “ldaps://".
When using “ldaps://" (LDAP over SSL) :lll

You need an X509 certificate for LDAP authentication.
The following fields of the certificate presented by the LDAPS server toCore must match the URL:o

the Common Name (CN)othe Subject Alternative Name (SAN)othe DNS nameIf no match exists, the connection request fails.

NOTE: If the certificate has a SAN field, Core ignores the CN value andseeks a match in the SAN list. Using the CN field is deprecated.
Therefore, Core checks the CN only if the SAN is not present.
You do not need to specify the ports when you use these default ports: 389(LDAP) or 636 (LDAPS).
Directory Failover URL

Enter a secondary URL, if available.

Directory UserID

Enter the primary user ID, for example, userid@local.domain. Make sure toinclude the domain, e.g., @local.domain, with the user ID.

Directory Password

Enter the password for the user ID set above.

Search Results Timeout

Do not change default of 30 seconds unless you get connection errors.

Getting Started with MobileIron Core 11.0.0.0| 43

Changing the LDAP Server Sync Interval

TABLE 5. LDAP SERVER FIELDS (CONT.)
FieldsDescription

Chase Referrals

Select Enable if you are using a multi-forested domain. This indicates you want
to use alternate domain controllers when the targeted domain controller does nothave a copy of the requested object.
Select Disable if you do not use alternate domain controllers.
NOTE: Enabling the Chase Referrals option delays LDAP authentication.

Admin State

Select Enable to put the server to service. Make sure to enable the Admin stateor the LDAP server will be invisible.

Directory Type

Select Domino for the IBM Lotus Domino server platform. The default DN andother LDAP search filters are automatically changed to the Domino server.
Select Active Directory for the Microsoft Windows server platform.

DomainEnter the domain name for the Active Directory. This information willautomatically traverse all levels of the tree and use to populate Base DN, parent
entry.

Changing the LDAP Server Sync Interval
The default interval for synchronization between MobileIron Core and the LDAP server is 24 hours. You can change
this interval for all configured LDAP servers. You might want to change the interval to ensure updated information
when the LDAP server data is changing frequently.
NOTE: For LDAP groups, each synchronization syncs only the LDAP groups that you specified in the LDAP
Setting page for each LDAP server at Services > LDAP.
To change the LDAP sync interval:
Procedure
1. From the Admin Portal, go to Services > LDAP > Preferences.
2. Select the preferred interval from the drop-down.
Intervals range from 15 minutes to 24 hours.
3. Click Save.

Managing LDAP users
Once you have configured one or more LDAP servers, the associated LDAP entities can be displayed in the
Devices & Users > Users screen. LDAP entities are useful for assigning roles that are inherited by the membersof an entity. LDAP users are immediately available for device registration.

Getting Started with MobileIron Core 11.0.0.0| 44

Configuring the set of LDAP groups

For each LDAP server you configured, you specified the set of LDAP groups that MobileIron Core gets from the
LDAP server. Specifying this set improves Core performance when you use the Admin Portal to access LDAP
groups. Because Core has already stored all necessary LDAP group information, no immediate communication
with the LDAP server is necessary to complete a task involving LDAP groups.
Note The Following:If you want an LDAP user to have access to the user portal, then you must assign the User Portalrole. Likewise, access to features in the Admin Portal requires the appropriate roles.
Avoid creating user IDs that include _MIxx, where xx is a number. This sequence is reserved for user
IDs requiring special processing, which includes stripping the _MI sequence and all characters
following it.
Core supports Apple User Enrollment for LDAP Users and LDAP Groups. See "User Enrollment" in the MobileIron
Core Device Management Guide for iOS and macOS Devices.

Configuring the set of LDAP groups
During MobileIron Core installation, you configure the set of LDAP groups that you can reference in Core.
Procedure
1. From the Admin Portal, go to Services > LDAP.
2. Select an LDAP server and click the Edit icon.
3. In the Modifying LDAP Setting page, scroll down to the LDAP Groups setting.
4. In the Search By LDAP Groups field, enter the first characters of an LDAP Group you want to select.
5. Click the search icon.
The LDAP Groups in the LDAP server that match the search request appear in the Available section.
6. Click the right arrow to move one or more LDAP groups to the Selected section.
7. Repeat steps 4 through 6 for other LDAP Groups.
8. Click Save.

Displaying available LDAP users
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Select LDAP Entities from the To drop-down list.

Getting Started with MobileIron Core 11.0.0.0| 45

Deleting LDAP entities without roles

3. Select LDAP Users from the Category drop-down list.
4. In the Search by Name field, enter text that will match an LDAP user entry in the selected category,based on first name, last name, or account name.
You may use % as a wildcard. For example, to search for all users having “smith” at the end of the user ID,
you would enter %smith .
5. Click the search icon.
The matching user records display.
LDAP does not report members for a group that is also the Primary Group for those members. If you do not see theusers you expect, examine your LDAP configuration. Consider using organizational units (OUs), instead.

Deleting LDAP entities without roles
MobileIron Core displays all LDAP entities, by default, whether or not they have a role assigned or if the role has
been revoked. However, you can group all LDAP entities together that do not have roles and delete them at one
time.
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Select LDAP Entities from the To drop-down list.
3. Select LDAP Entities without Roles from the Category drop-down list.
4. Select or search for one, some, or all of the LDAP entities without roles.
5. Click Actions > Delete > Yes.

Getting Started with MobileIron Core 11.0.0.0| 46

Viewing LDAP user/group associations

Viewing LDAP user/group associations
The Users screen includes links for displaying associations between users and groups. For example, if you haveassigned a role to the Engineering group, you can display the users associated with that group.

FIGURE 6. VIEWING LDAP ASSOCIATIONS

Synchronizing with the LDAP server
LDAP Sync returns all Lightweight Directory Access Protocol (LDAP) Organizational Unit (OU) information. This
information is used to correlate users in the Core to their OUs. It syncs only the OU information itself, not all the
OU user information, which would affect performance. MobileIron synchronizes user data from the LDAP server
every 24 hours, by default.
Note The Following:
When syncing LDAP records with MobileIron Core, if any data integrity errors occur within thebatch, only the failed record is discarded.
For LDAP groups, each synchronization syncs only the LDAP groups you specified in the Services >LDAP > LDAP Setting page.
Procedure
To synchronize with the LDAP server:
1. From Core Devices & Users > Users page, select LDAP Entities from the To drop-down menu.
2. Click Resync With LDAP. A confirmation message displays.

Getting Started with MobileIron Core 11.0.0.0| 47

Changing the LDAP Sync Interval

FIGURE 7. SYNCHRONIZING WITH THE LDAP SERVER

NOTE: If no LDAP servers are configured, the Resync with LDAP button does not appear.

Changing the LDAP Sync Interval
You can configure the amount of time you want between each synchronization with LDAP servers.
Procedure
1. From the Admin Portal, go to Services > LDAP > Preferences.
2. Select the preferred interval from the drop-down.
3. Click Save.

Suspending scheduled LDAP synchronization globally
You can stop scheduled LDAP synchronization globally in your MobileIron Core instance. Suspending LDAP
synchronization helps prevent losing label associations with devices during maintenance actions such as:l

MobileIron Core maintenancel

AD or LDAP server maintenance

NOTE: Any users added to your Core deployment during the time LDAP synchronization is suspended
are not added to Core until scheduled LDAP synchronization is resumed.
Procedure
1. From the Admin Portal, go to Services > LDAP.
2. In Preferences, uncheck Enable LDAP Sync with Core.

Getting Started with MobileIron Core 11.0.0.0| 48

Resuming scheduled LDAP synchronization

3. Click Save.
4. Click OK when the confirmation message displays.
NOTE: MobileIron Core enables you to manually synchronize LDAP servers while LDAP synchronization issuspended (see Synchronizing your LDAP server manually)

Resuming scheduled LDAP synchronization
Use the LDAP option on the Services menu to resume scheduled LDAP synchronization.
Procedure
1. From the Admin Portal, go to Services > LDAP.
2. In Preferences, check Enable LDAP Sync with Core.

3. Click Save.
4. Click OK when the confirmation message displays.

Synchronizing your LDAP server manually
You can synchronize your LDAP server manually.
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Click Resync With LDAP.

Setting the LDAP sync discard option
The LDAP sync discard option under LDAP preferences provides control over:Getting Started with MobileIron Core 11.0.0.0| 49

Setting the LDAP sync discard option

l

l

l

whether to apply the discard policy to individual LDAP Groups as well as global, or global only.
whether to discard the LDAP sync data if the reloaded data set declines significantly. Discarding the sync
data means that no LDAP data additions, changes, or deletions are made on MobileIron Core.
at what point the decline is considered significant. You can specify the decline of users as a percentage ora number. The percentage or number is compared against the following:othe total number of LDAP users in Coreothe number of users in each top-level LDAP group. A top-level LDAP group is one of the LDAP groups
that you selected in the LDAP setting at Services > LDAP in the Admin Portal.

The LDAP sync discard option is enabled by default and set to 25%.
Using this option ensures that removing a number of users on the LDAP system in excess of the configured
percentage or number does not result in the deletion of users in the MobileIron Core database. Consider changing
or disabling this setting if you are going to make major changes to your LDAP system.
Note The Following:
l

l

l

l

l

MobileIron Core discards the sync data only if the net decrease of users is greater than the specified
percentage or number.
For example, if 999 users had been removed from a group, and 1000 different users had been added to thesame group, MobileIron Core does not discard the LDAP sync data. The sync data is not discarded
because the net change was 1 user. Therefore, MobileIron Core will remove the 999 users.
Changes on the LDAP server of information associated with a user (such as LDAP attributes,
distinguished name, email, or country of origin) do not impact whether Core discards the LDAP sync data.
However, changes in group membership can impact whether Core discards LDAP sync data.
For example, if 1000 users were moved from one LDAP group to another, and the threshold number is 500,
MobileIron Core will discard the LDAP sync data, and no changes are made on MobileIron Core.
However, if only 400 users were moved from one LDAP group to another, and the threshold number is 500,
MobileIron Core does not discard the LDAP sync data. Therefore, if you had assigned a different set ofroles or labels to each of the LDAP groups, users that were moved from one group to another would be
associated with a different set of roles or labels. Depending on the change, users could no longer have theconfigurations, profiles, or policies that they require to access email, apps, or content critical to their job.

IMPORTANT: Be sure to confirm that the changes are acceptable before disabling this feature. Leaving
it disabled can allow an LDAP server configuration change to remove every LDAP userfrom the MobileIron Core database. That removal can cause catastrophic changes
affecting a user’s labels which impacts capabilities such as access to email and apps.
Procedure
1. From the Admin Portal, go to Services > LDAP.
2. In preferences, go to Enable sync Discard.

Getting Started with MobileIron Core 11.0.0.0| 50

When the LDAP sync declines

3. The default choice is Group and Global, which allows you to enable sync discard for individual LDAPGroups, as well as global (top-level group).
4. If you select Discard if reloaded LDAP data decreases by more than <25>%, LDAP sync data will bediscarded if reloaded LDAP data decreases by more than the threshold percentage.
5. If you select Discard if reloaded LDAP data decreases by more than <value> users, LDAP sync data
will be discarded if reloaded LDAP data decreases by more than the threshold number of users.
6. Click Save.
Related topics
See also Impacts of Making LDAP Changes, Configuring LDAP servers

When the LDAP sync declines
Typical reasons for a significant decline in the LDAP sync include:lchanges in the LDAP environmentlslow response from the LDAP serverlnetwork congestion

LDAP sync history is available in the System Manager under Troubleshooting > Service Diagnosis. Click
LDAP Sync History.
Consider the following steps when the sync fails because of discarding the LDAP sync data:
1. Did the issue first start at about the same time as a major change to the LDAP environment?
This would suggest that a valid change in the LDAP environment triggered the discard.
2. Has the sync failed once or multiple times?
If sync has failed once, try a manual sync. If the LDAP sync continues to fail, check with the LDAP
administrator for changes in the LDAP environment that could cause:lgroups being removedlusers being removed from referenced groups or groups within those groups (child groups)

3. Determine whether these LDAP changes were expected. Assuming the changes were expected, do thefollowing:

Getting Started with MobileIron Core 11.0.0.0| 51

Impacts of Making LDAP ChangeslModify the LDAP sync discard percentage to allow MobileIron Core to apply (not discard) the LDAP
sync.

l

Run a manual LDAP sync. Make sure it succeeds.

lModify the LDAP sync discard percentage or number back to your previously determined safe level.

Impacts of Making LDAP Changes
Making changes in your LDAP implementation can result in removal of devices from MobileIron Core labels, which
also removes Core policies, configurations, and apps applied using those labels. This results when the information
stored in the database on Core differs from the information returned by Core’s LDAP sync process. For example, if
your Core implementation uses labels based on LDAP group membership, then removing all configurations in yourLDAP implementation would cause the LDAP sync process to determine that those associations no longer exist.
Because the Enable Sync Discard option is based on a percentage or specified number change of the total numberof users or the users in each top-level group, if this option is also unchecked, then the magnitude of the change
does not prevent Core from making sweeping changes to your managed devices.
If you intend to make major changes to your LDAP implementation, consider the following precautions:lTemporarily turn off the Enable LDAP Sync with Core option.

lTemporarily turn on the Enable Sync Discard option.

Deleting LDAP data from the MobileIron Core database
WARNING: Typically, you delete all LDAP data from the MobileIron Core database only on a test
environment. The reason is that deleting all LDAP data leads to the following:lll

All labels populated by LDAP group membership will be removed from users and devices, because theusers will no longer be associated with any groups.
All policies, configurations, and apps dependent on those labels to be applied to a device will be removed.
LDAP group and user role assignments will still be present on MobileIron Core, even though, with the
LDAP setting disabled, the user will not be able to login.

Therefore, use the following process to delete LDAP data from the Core database only if you understand the above
impact.
Procedure
1. Disable or delete all existing LDAP settings.
These can be disabled by editing an LDAP setting under Services > LDAP and changing the Admin
State from Enabled to Disabled.
2. Uncheck Enable Sync Discard under Services > LDAP > Preferences.
3. Either trigger a manual LDAP sync or wait for a regular LDAP sync.

Getting Started with MobileIron Core 11.0.0.0| 52

Deleting LDAP users

4. After the LDAP sync has completed successfully, confirm device label association changes havecompleted.

Deleting LDAP users
You can delete an LDAP user if that user is not associated with a registered device.
Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Users.
3. Click the check box for the user you want to delete.
4. Select Actions > Delete User.

Moving between the LDAP entity display and the local user viewTo see the list of local users and LDAP users on the Devices & Users > Users page, select Authorized Users
from the To: drop-down list. To see the LDAP entities, select LDAP Entities.

Assigning and removing device user roles
The Manage administrators and device spaces role is required for this task. Assign roles to enable access to
product features available through the user portal.
NOTE: When modifying permissions or roles for local or LDAP users, you must log out and log back in to
the Admin Portal for your changes to take effect.
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Select one or more local users or LDAP groups.
Use the To: field to change between displaying local users and LDAP entities.
3. Click Actions and select Assign Roles.
4. Select roles for the users.
5. Click Save.
MobileIron Core recognizes the following roles for device users:

TABLE 6. USER ROLES
Roles

Description

User Portal

Allows access to the user portal.

Getting Started with MobileIron Core 11.0.0.0| 53

Assigning and removing device user roles

TABLE 6. USER ROLES (CONT.)
Roles

Description
For Windows Phone (8.0) this role is required for registration.
With User Portal selected, you can choose to enable or disable the following roles:lWipe DevicelLock DevicelUnlock DevicelLocate DevicelRetire DevicelRegister DevicelChange Device OwnershiplReset PINlReset Secure Apps Passcode

NOTE: Local administrative users must be assigned the User Portal role toallow them to reset their password.
Local users receive User Portal access by default, but LDAP users do not.
Wipe Device

Enables device users to wipe their phones through the user portal.
Warning: Wipe is destructive and cannot be reversed. Do not select this option
unless you want to enable end users to wipe their devices.

Lock Device

Enables device users to lock their phones from the user portal.

Unlock Device

Enables device users to unlock their phones through the user portal.

Locate Device

Enables device users to locate their phones from the user portal.

Retire Device

Enables device users to unregister their phones through the user portal.

Register Device

Enables device users to register phones from the user portal.

Change Device
Ownership

Enables device users to change ownership from Employee Owned to Company
Owned or vice-versa.
Changing device ownership from company-owned to employee-owned or vice-versa
may impact:lthe policies and configurations that are applied to the device.

lthe apps that are available through Apps@Work.

liBooks that are available on the device.

Devices are impacted when they check-in with MobileIron depending on the labels
to which company-owned or employee-owned devices are applied.

Getting Started with MobileIron Core 11.0.0.0| 54

Managing local users in the Admin Portal

TABLE 6. USER ROLES (CONT.)
Roles

Description

Reset PIN

Enables device users to reset the device PIN on Windows devices.

Reset Secure Apps
Passcode

Enables device users to reset the secure apps passcode on Android and iOS
devices.

Use Google Device

This selection is for configuring the Android shared-kiosk mode. See "Configuring a

Account (for Android

staging user" in the MobileIron Core Device Management Guide for Android andAndroid enterprise Devices.

enterprise device only)
Use Apple User
Enrollment (For Apple
unsupervised device

This selection is for User Enrollment with Apple Business Manager. For more
information, see "User Enrollment with Apple Business Manager" in the MobileIron
Core Device Management Guide for iOS and macOS Devices.

only)
Enable Authenticator
Only Role

Select to enable users to register their unmanaged mobile device in Authenticator
Only mode. This user role designates an unmanaged mobile device as the user's
identity and authentication factor. Designating a mobile device as the user's identity
allows users to take advantage of Zero Sign-on features, which allow passwordlessaccess to SaaS applications and other business services.
NOTE: If the role is removed, the devices registered by user are also retired.
When you assign the Enable Authenticator Only Role to a user, the Retire
Device and Register Device User Portal roles are selected by default. The Retire
Device and Register Device roles are the only User Portal roles available for
Authenticator Only users. All other User Portal roles are grayed out.
For information about registering devices in Authenticator Only mode, see"Authenticator Only with MobileIron Access" in the MobileIron Access Guide.

The new roles take effect the next time an affected user logs in. A user who is logged in when the change is mademust log out and log back in to see the effects of the change.

Managing local users in the Admin Portal
This section explains how to manage local users in the Admin Portal. For information on managing local users in
System Manager, refer to MobileIron Core System Manager Guide. Local users that you create in the Admin
Portal are separate from the local users that you create in the System Manager.

Adding local users in the Admin Portal
Required role: The Manage user role is required for completing this task. See Assigning and removing deviceuser roles for more information.

Getting Started with MobileIron Core 11.0.0.0| 55

Add New User window

NOTE: Avoid creating user IDs that include _MIxx, where xx is a number. This sequence is reserved for user
IDs requiring special processing, which includes stripping the _MI sequence and all characters
following it.
Procedure
1. From the Admin Portal, go to Devices & Users > Users to open the Users window.

2. Select Add > Add Local User. The Add New user window displays.

3. Refer to the following guidelines to complete the information:
4. Add the new user. Refer to the Add New User window for details.
5. Click Save.
6. Assign the necessary roles to users. See Assigning and removing device user roles.

Add New User window
Use the following guidelines to complete the information:

Getting Started with MobileIron Core 11.0.0.0| 56

Editing local users in the Admin Portal

TABLE 7. ADD NEW USER TABLE
Field

Description

User IDEnter the unique identifier to assign to this user. The following characters areallowed when entering a UserID. All other characters, including spaces, areprohibited.
lLetters (uppercase and lowercase)lNumbers (0-9)

lDashes (-)

l

Underscores (_)

l

Periods (.)

lAt sign (@)

l

Dollar sign ($)

lHash tag (#)

l

Extended ASCII/UTF-8

NOTE: If you are using local users and LDAP users, the user ID cannot matchthat of an LDAP user.
First NameEnter the user’s first name.

Last NameEnter the user’s last name.

Display Name

Optional name used to identify the device user. If you leave this field blank, thenthe display name will have the following format:
Firstname Lastname

Password

Enter a password for the user.
Valid passwords are determined by the password policy for local users.
For details, see:l

Local user password policy overview

lSetting the password policy for local users

Confirm Password

Confirm the password for the user.

EmailEnter the user’s email address.

Editing local users in the Admin Portal
Required role: The Manage user role is required for completing this task. See Assigning and removing device user
roles for more information.
You can edit account information for local users. For example, you can:Getting Started with MobileIron Core 11.0.0.0| 57

Linking local users to LDAP userslchange the user’s MobileIron passwordledit the first name, last name, or display namelupdate the email address

You cannot change the User ID.
To edit local user account information:
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Click the Edit icon for the user entry to display the Edit User dialog.
3. Make the changes to the displayed information. See Adding local users in the Admin Portal for informationon completing each field.
4. To change the user password, click the Change Password link, and then enter the old password, the new
password, and the new password again in the space provided.
5. Click Save.

Linking local users to LDAP users
A local user can be matched with its corresponding LDAP user. For example, suppose you created a local user for
preliminary system rollout and testing, but for the production rollout, you want that user matched with their LDAP
equivalent.
To match a local user to their corresponding LDAP entry:
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Click the check box for the local user you want to match.
3. Select Actions > Link to LDAP.
NOTE: Existing roles for the local user are removed. The next time the user authenticates, roles will beapplied based on the LDAP group of the corresponding LDAP user.

Deleting local users in the Admin Portal
You can delete a local user if that user is not associated with a registered device.
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Click the check box for the user you want to delete.
3. Select Actions > Delete User.

Getting Started with MobileIron Core 11.0.0.0| 58

Forcing a password change for local users

Forcing a password change for local users
If there is a possibility that a local user’s credentials have been exposed or compromised, you can force that user tochange the password during the next login. For example, if you have emailed credentials, you should consider
forcing the user to set a new password.
Procedure
1. From the Admin Portal, go to Devices & Users > Users.
2. Select the user whose password you want to change.
3. Select Actions > Require Password Change button.
4. Click Yes to confirm the action.
5. The next time the user completes a successful login, the MobileIron login window displays, prompting theuser to set a new password.

Local user password policy overview
You can specify the password policy for local users.
The password policy includes the following:ll

Enforcement type, which is one of the following:oLocal user password complexity enforcementoLocal user password strength enforcement

Core enforces the password complexity or strength when:o

You add a new local user in the Admin Portal in Devices & Users > Users.

oLocal users change their password.

Getting Started with MobileIron Core 11.0.0.0| 59

Local user password complexity enforcementlNumber of failed attempts
After the local user fails to enter the correct password after the specified number of attempts, Core does
not allow the user to login until the specified auto-lock time has expired.

l

Password history enforcement
When you enforce password history, the local user cannot use the previous 4 passwords when changing
his password.

Related topicslSetting the password policy for local usersl

Local user password complexity enforcement details

Local user password complexity enforcement
You can enforce password complexity requirements on local user passwords. Complex requirements prevent local
users from using passwords that are weak and therefore easy to guess. However, requirements that are toocomplex make using the user ID and password inconvenient for the user because they have to enter a more
complicated or longer password. Therefore, when you choose the complexity requirements, consider both yoursecurity needs and you local user convenience.
You specify the following password complexity requirements:l

Minimum and maximum password lengthl

Minimum number of character classes in a passwordlCharacter classes are:oLower case alphabetic charactersoUpper case alphabetic characterso

Numeric characters 0 through 9oSpecial characters, which are ! = ( { [ _ : - ; ~ , ) } ] @ # ^ | $In addition to the requirements that you specify, Core enforces the following requirements:l

The password cannot have 4 or more repeating characters.

l

The password cannot be the same as the user ID.

Related topicslSetting the password policy for local usersl

Local user password complexity enforcement details

Getting Started with MobileIron Core 11.0.0.0| 60

Local user password strength enforcement

Local user password strength enforcement
You can specify the local user password strength to enforce how strong a password must be. Setting the password
strength prevents local users from using passwords that are weak and therefore easy to guess. However, setting
the password strength too high makes using the user ID and password inconvenient for the user because they
have to enter a more complicated or longer password. Therefore, when you choose the password strength
requirement, consider both your security needs and your local user convenience.
In addition to your specified password strength, Core enforces the following requirements:l

The password length must be 128 or less.

l

The password cannot be the same as the user ID.

Related topicslSetting the password policy for local usersl

Local user password strength enforcement details

Setting the password policy for local users
On the password policy for local users, you specify their password requirements.
Procedure
1. Log into the Admin Portal.
2. Go to Settings > Security > Password Policy.
3. Select one of these options, and modify one or more of the default fields, as necessary:
Enable Password Complexity Enforcement. See Local user password complexity enforcement details.
Enable Password Strength Enforcement. See Local user password strength enforcement details.
4. Click Save.
NOTE: Click Reset to Default followed by Save to reset the password policy to the default values.
Related topicslLocal user password policy overview

Local user password complexity enforcement details
The following table summarizes the fields of the local user password policy when using password complexity
enforcement:

Getting Started with MobileIron Core 11.0.0.0| 61

Local user password complexity enforcement details

TABLE 8. FIELDS FOR LOCAL USER PASSWORD COMPLEXITY ENFORCEMENT
Field

Description

Default value

Enable Password
Complexity Enforcement

Select this field when you want to apply password
complexity requirements to local user passwords.

Selected

Number of Failed
attempts

Specify the number of failed attempts that a local user canmake when entering his password.

5

After this number of attempts, Core does not allow the user
to login until the specified auto-lock time has expired. Afterthe auto-lock time expires, each failed login attempt resultsin Core not allowing the user to login until the auto-lock time
expires again.
Valid values are 1 through 16.
Auto-Lock Time

Specify how much time in seconds the local user must wait
before he can log in after exceeding the number of failed
attempts.

30

Valid values are 0 through 3600 seconds.
Enforce Passcode History(Last 4 passwords)

Select Enable if you do not want to allow a local user to use
the previous 4 passwords when changing his password.

EnableTo allow a local user to use the previous 4 passwords, selectDisable.
Minimum number ofcharacter classes inpassword

This field is only available when you selected Enable
Password Complexity Enforcement.

3

Select the minimum number of different character classes(lower case, upper case, numeric, and special character) thatyou require in a password.
For each character class, you select whether it counts
towards the minimum number.The minimum number must be
less than or equal to the number of character classes you
select.
For example, if the minimum number of character classes is2, you can select 2 or more of the character classes. In thiscase, if you select Lower Case, Upper Case, andNumeric, the password must contain at least 2 of thosecharacter classes.

Lower Case

Select this option if the lower case character class counts
towards the minimum number of character classes that you
require in a password.

Selected

The lower case character class includes the lower casealphabetic characters ‘a’ through ‘z’.

Getting Started with MobileIron Core 11.0.0.0| 62

Local user password strength enforcement details

TABLE 8. FIELDS FOR LOCAL USER PASSWORD COMPLEXITY ENFORCEMENT (CONT.)
Field

Description

Default value

Upper Case

Select this option if the upper case character class counts
towards the minimum number of character classes that you
require in a password.

Selected

The lower case character class includes the upper casealphabetic characters ‘A’ through ‘Z’.
Numeric

Select this option if the numeric character class counts
towards the minimum number of character classes that you
require in a password.

Selected

The numeric character class includes the characters ‘0’
through ‘9’.
Special Character

Select this option if the special character class counts
towards the minimum number of character classes that you
require in a password.

Not selected

The special character class includes these characters:!=({[_:-;~,)}]@ #^|$Min Password Length

Select the minimum number of characters in a password.
Valid values are 6 through 16.

8

For Android devices: When the Don't Care option is set for
the Password Type field, the Password Length field does
not apply.
Max Password Length

Select the maximum number of characters in a password.
Valid values are 21 through 128.

32

Related topicslLocal user password policy overview

lSetting the password policy for local users

Local user password strength enforcement details
The following table summarizes the fields of the local user password policy when using password strength
enforcement:

Getting Started with MobileIron Core 11.0.0.0| 63

Local user password strength value descriptions

TABLE 9. FIELDS FOR LOCAL USER PASSWORD STRENGTH ENFORCEMENT
Field

Description

Default value

Enable Password
Strength Enforcement

Select this field when you want to apply password strength
requirements to local user passwords.

Not selected

Number of Failed attempts

Specify the number of failed attempts that a local user canmake when entering his password.

5

After this number of attempts, Core does not allow the user
to login until the specified auto-lock time has expired. Afterthe auto-lock time expires, each failed login attempt resultsin Core not allowing the user to login until the auto-lock time
expires again.
Valid values are 1 through 16.
Auto-Lock Time

Specify how much time in seconds the local user must wait
before he can log in after exceeding the number of failed
attempts.

30

Valid values are 0 through 3600 seconds.
Enforce Passcode History(Last 4 passwords)

Select Enable if you do not want to allow a local user to use
the previous 4 passwords when changing his password.

EnableTo allow a local user to use the previous 4 passwords, selectDisable.
Password Strength

Select a value between 0 and 100, where 0 is the weakest
requirement, and 100 is the strongest requirement.

35

You can enter a value or move the slider.
For details, see Local user password strength value
descriptions.
Related topicslLocal user password policy overview

lSetting the password policy for local users

Local user password strength value descriptions
The following table describes the local user password strength values:

Getting Started with MobileIron Core 11.0.0.0| 64

Local user password strength value descriptions

TABLE 10. LOCAL USER PASSWORD STRENGTH VALUE DESCRIPTIONSStrengthvalue

Description

0 - 20

Weak: risky password

Examplesl

Few characters: zxcvbn

lSequences: abcdefghijk987654321

lNames: briansmith4mayorlWords: vikingl

21 - 40

Fair: protection from throttled online
attackslThrottled online attacks are attacks toguess the passcode which are:l

Words plus numbers: temppass22lNames plus numbers: ryanhunter2000

lon the devicelrate-limited

Rate-limited attacks are limited tosome number of attempts per time
period.
41 - 60

Words with number substitutions:
ScoRpi0nsllGood: protection from unthrottled
online attackslUnthrottled online attacks are attacks toguess the passcode which are:ll

on the devicel

not rate-limitedl

Few characters but with special
characters: qwER43@!

Words with special character andnumber substitutions: R0$38uD99
Names with capitalization:verlineVANDERMARKLonger words with special character andnumber substitutions: Tr0ub4dour&3
Longer phrases with numbers andspecial characters:
neverforget13/3/1997
Longer letter, number, and special
character combinations:asdfghju7654rewq, AOEUIDHG&*()LS

Getting Started with MobileIron Core 11.0.0.0| 65

Local user password strength value descriptions

TABLE 10. LOCAL USER PASSWORD STRENGTH VALUE DESCRIPTIONS (CONT.)
Strengthvalue

Description

61 - 80

Strong: moderate protection fromoffline slow-hash scenario
An offline slow-hash scenario is asophisticated algorithm for guessing apasscode. The algorithm runs offline fromthe device after copying passcode-related
files from the device.

81 - 100

Very strong: strong protection fromoffline slow-hash scenario

ExampleslLonger random letters and numbers:
zevusqr3
resqu3Wil
tgbvdnjukllLonger phrases with numbers andspecial characters: Compl3xChar$
Very long random characters:
eheuczkqyq
rWibMFACxAUGZmxhVncy
Ba9ZyWABu99[BK#6MBgbH88Tofv)vs$w

llLong phrases:
correcthorsebatterystaple
Long phrases with substitutions:
coRrecth0rseba++ery9.23.2007staple$

Related topicslLocal user password policy overview

lSetting the password policy for local users

Getting Started with MobileIron Core 11.0.0.0| 66

5Managing Devices
A device is available for management by MobileIron Core after it has been registered by a device user oradministrator. This chapter covers the following topics:l

Devices & Users pageslDisplaying device assetslSingle device registrationlBulk device registrationlTracking registration statusl

Restricting the number of devices a user registerslRegistration considerationslUsing bulk enrollment for Android devices

Refer to the Device Management Guide for other device-related topics. The following table lists advanced topics
related to device registration.

TABLE 11. DEVICE REGISTRATION ADVANCED TOPICS
Registration topic
l

l

l

l

Specifying eligible platforms for registration

OS
All

Configuring user authentication requirements forregistration
Customizing registration messages
Configuring the default ownership for newly registereddevices

Web-based registration for Android deviceslWeb-based registration iOS and macOS deviceslRemoving an MDM profile

Registration by invitationlIn-app registration for iOS and Androidl

Visual privacylActiveSync device registrationlManaging operators and countries

Android
iOS, macOS

Windows
Android, iOS

Android, iOS, Windows

Getting Started with MobileIron Core 11.0.0.0| 67

Devices & Users pages

NOTE: Some features are not applicable if you use MAM-only iOS or Android devices. For more
information, see “Managing apps on MAM-only devices” in the MobileIron Core Apps@Work
Guide.
.

Devices & Users pages
The Device & Users pages enable you to manage enterprise devices. Use these pages to:lRegister/enroll a new device and associate it with a userlRegister/enroll devices in bulk modelDisplay a list of registered deviceslView and manage devices connected through ActiveSyncl

Apply labels in order to group deviceslCreate, edit, and delete labelsl

Locate, Lock, Wipe or perform other administrative actions on a device.

lManage Apple Device Enrollment Program and Apple School Manager devices.

Access to Devices & Users pages
To view the Users page, you must have the Manage user role. To view the Devices page, you must have the View
device role or a role that includes that permission.

Displaying device assets
Go to the Device & Users > Devices page to display the devices being managed by MobileIron. The following
information displays for each device, by default. The columns are configurable.

TABLE 12. DEVICE ASSETS FIELDS
ColumnDescription

Display Name

Displays the full name of the user registered with this phone.

Current Phone
Number

Displays the phone number.

Model

Displays the make and model of the device.
For iOS:If you have MDM for iOS enabled and the View MDM Alerts option selected under
Settings > System Settings > iOS > MDM, then entries for iOS devices that needattention will include alert icons. See “Alerts displayed in the Devices page on page 71

Getting Started with MobileIron Core 11.0.0.0| 68

Configuring the Devices page display

TABLE 12. DEVICE ASSETS FIELDS (CONT.)
ColumnDescription
for information on alerts and what they mean.

Manufacturer

Displays the name of the company that manufactures the device.

Platform Name

Displays the operating system running on the phone as reported by the MobileIron
client running on the phone.

Home Country
Name

Displays the home country for the device.

Status

Displays the state for each device:
l

l

l

l

l

Pending means that the user’s device has been registered on the MobileIron
Server, but the MobileIron Client download has not yet been completed.
Verified means that the user has confirmed that the download of the
MobileIron Client should proceed.
Active means that the MobileIron Client has been successfully downloaded
and connected back to MobileIron Core at least once.
Lost means that this phone has been manually marked as Lost. This status
does not affect other functionality.
Wiped means that the phone has been restored to factory defaults.

Registration Date

Date the device registered.

Last Check-In

Displays the elapsed time since the device was able to update profiles andconfigurations from MobileIron Core.

Owner

Displays whether the device is owned by the company or employee.

Operator

Displays the name of the service provider specified when the phone was registeredwith MobileIron.

Configuring the Devices page display
You can determine what information displays in the Devices page, such as IP address and battery level.
NOTE: The selected columns are only retained from session to session for the same user who is using thesame browser. In all other situations, the columns displayed on the Devices page revert to thedefault columns.
Procedure
1. In the Admin Portal, go to Devices & Users > Devices.
2. Click the gear icon at the right of the Devices page.

Getting Started with MobileIron Core 11.0.0.0| 69

Devices page information types

3. Check and uncheck boxes to select the device information to display on the Devices page. The
information types are listed in Table 13 on page 70.
For example, uncheck Display Name to remove that column, or check Battery Level to add that column.
The columns are added and removed from the page as you check and remove checks from the list.
The columns are displayed on the Devices page in the order listed beneath the gear icon.

Devices page information types
Use the information in the following table as you set up the Devices page.

TABLE 13. DEVICE PAGE FIELDS
Information Type

Description

Display Name

Optional device user name (displayed by default).

Current Phone Number

Current device phone number (displayed by default).

Model

Device model (displayed by default).

Manufacturer

Device manufacturer (displayed by default).

Platform Name

Device platform name (displayed by default).

Home Country Name

Device home country (displayed by default).

StatusDevice status, for example, Active (displayed by default).

Registration Date

Date device registered with MobileIron Core (displayed by default).

Last Check-in

Time of last device check-in (displayed by default).

Connected

Lists whether device is currently connected (applies to Android “always
connected” devices only).

Owner

Device owner (displayed by default).

Operator

Carrier device uses (displayed by default).

Language

Language device uses.

Email Address

Device email address.

Battery Level

Device power level.

Client Name

MobileIron client the device uses.

Client Version

Version of the MobileIron client the device uses.

Data Protection

Displays whether data protection is set or not for the device.

Data Roaming Enabled

Displays whether data roaming is enabled or not for the device.

Getting Started with MobileIron Core 11.0.0.0| 70

Alerts displayed in the Devices page

TABLE 13. DEVICE PAGE FIELDS (CONT.)
Information Type

Description

Device Admin Enabled

List whether device administrator privilege is enabled.

Device is Compromised

Indicates whether the device has been compromised.

Device Locale

Lists the device locale.

Device UUID

The device UUID.

Ethernet

Lists the Ethernet MAC.

IMEI

Lists the IMEI value.

IMSI

Lists the IMSI value.

IP Address

IP address of the device.

iPhone ICCID

Lists the integrated circuit card identifier (ICCID) for the iPhone or iPad,which is an international identifier for the SIM.

iPhone MAC Address

Lists the MAC address for an iPhone device.

iPhone UDID

Lists the Unique Device Identifier for the Apple device.

iPhone Version

Lists the version of an iPhone.

Device Name

Name assigned the device.

OS Version

OS version the device uses.

Apple Education role

Indicates whether the device has an Apple School Manager role applied toit, specifically Teacher or Student.

Apple Education enabled

Indicates whether Apple Education is enabled on the device, meaning
Apple School Manager.

Alerts displayed in the Devices page
The Devices page alert icons table describes the alerts that may be displayed in the Device & Users > Devices
page (Device column) for devices. These alert icons apply to Anrdoid and iOS devices only.

Getting Started with MobileIron Core 11.0.0.0| 71

Alerts displayed in the Devices page

TABLE 14. DEVICES PAGE ALERT ICONS
Alert
Icon

Alert Name

Description

ActionData
Protection
Disabled(iOS only)

Data Protection:

Display the tooltip for the alert
icon.

MobileIron
iOS
Multitasking
is Disabled

One of the following MDM-mandated security
requirements is not being met:
• Passcode is not set• Encryption is not fully enabled
Multitasking:
The MobileIron multitasking feature for iOS is notenabled, most likely because Location Services has
not been enabled on the device.

For tooltip PasscodeRequired, inform the user that
MDM mandates setting apasscode on the device.
For tooltip Restore Required,inform the user that the device
must undergo a complete
restore after upgrade to fully
enable encryption features.
For tooltip MobileIron iOS
Multitasking is Disabled,
confirm that Location Services
is enabled on the device. On thedevice, enable location services
for Mobile@Work by selecting
Settings > Privacy > Location
Services > MobileIron.

Unlocked
DeviceThe OS has been compromised.

If the device connects to email
via ActiveSync, then block itusing the Block feature in the
ActiveSync Association page.
Inform the user that the device
must be restored.

App Control
Violation

An app control rule has been violated.

Expand the device’s Device
Details panel to see specificinformation on the violation. See
the MobileIron Core
Apps@Work Guide.

Getting Started with MobileIron Core 11.0.0.0| 72

Displaying more device and user information

TABLE 14. DEVICES PAGE ALERT ICONS (CONT.)
Alert
Icon

Alert Name

Description

ActionQuarantined(iOS only)

Configurations have been removed from the device

For more information, see“Viewing quarantine information”
in the MobileIron Core Device
Management Guide for iOS
Devices.

DeviceAdministrator
Not
Activated(Android)

Device Administrator Not Activated:

MDM Profile
Removed(iOS)

most of the device management features that

due to a security violation.

The device administrator privilege is not activatedfor the MobileIron app or the Samsung DM Agent.
The device administrator privilege is required forIf the device connects to email
via ActiveSync, then block itusing the Block feature in the
ActiveSync Association page.
Inform the user that the privilege
must be restored.

MobileIron provides. For more information on theSamsung DM Agent, see “Uninstalling theSamsung DM Agent” in the MobileIron Core Device
Management Guide for Android Devices.
MDM Profile Removed:
The MDM profile has been removed from thedevice. An MDM profile is required for the
MobileIron app on iOS to operate with fullfunctionality.

Displaying more device and user information
Detailed information about each device is available on the Device & Users > Devices page. To expand the device
details panel, find the device in the table, and click the caret next to the check box. The device details panel
expands immediately below the row. You can have multiple device detail panels open at once.
To close device details, click the X in the top right of the panel, or click the caret next to the check box.
When you expand the device details panel, the following displays on the left-hand side:l

Health Attestation (Windows only)l

Location Data (Windows only)lLink to view the Logsl

Link to Push Profiles (if applicable)lUser namelUser email

Getting Started with MobileIron Core 11.0.0.0| 73

Displaying more device and user informationlImage of the devicelPhone number (if applicable)lDevice modell

OS versionlDevice capacityl

Statusl

Last check-in timelRegistration datelOperatorlCountry namelDevice Space

The categories and information available on the right side of the Device Details panel are shown in the following
table:TABLE 15. DEVICE DETAILS PANEL
Category

Information Available

Device Details

Device-specific details received from the device. For more information, see “Validsearch fields” in the MobileIron V2 API Guide.

Policies

Status of policy distribution

LabelsLabels applied to this device

Logs

Click the links to view the logs. For iOS devices, you can only view logs if MDM isenabled.
Certificate Inventory
Profile Inventory
Provisioning Profile Inventory
Managed Apps Inventory
MDM Log (Android and iOS)

Apps

List of apps that are installed on the device.

iBooksList of iBooks that are present on the device (iOS only).

Configurations

Status of configurations distribution, e.g., Exchange, VPN, etc.

Compliance

App control rule violations, if any, appear here.

Comments

Added by a MobileIron administrator to record information about this device

Custom Attributes

Names of custom attributes assigned to the device. You can assign custom
attributes to users or devices to associate additional properties with these objects.
These properties can then be used to build groups or distribute configurations.

Getting Started with MobileIron Core 11.0.0.0| 74

Adding a comment to device details

For Android devices:l

For information about details displayed relating to AppConnect for Android, see the MobileIron Core
AppConnect and AppTunnel Guide.

For Windows 8.1 Phone devices:
In addition, the following information is also displayed for dual SIM phones:
l

IMEI2

l

IMSI2

l

Roaming2

Adding a comment to device details
The Comments tab in the device details panel enables you to add brief text to the device record.
Procedure
1. Click the Comments tab.
2. Enter the text.
3. Click Submit to save your changes, or Cancel to revert to the original comment.
4. The comment pane displays the date and time the comment was created or modified.

Displaying log data for a selected device
You can view log data for a particular device.
Procedure
1. From the Admin Portal, go to Device & Users > Devices.
2. Expand the device details panel by clicking the up arrow next to the check box.
3. Click the View Logs for Device link, found at the top left of the Device Details panel.

Single device registration
Administrators can register a single device from the Admin Portal. This method is best for the following scenarios:ladding the first few devices to a new systemladding a few new devices to an existing system

This section contains the following topics for single device registration:

Getting Started with MobileIron Core 11.0.0.0| 75

Prerequisites for registering a single devicelPrerequisites for registering a single devicelRegistering a single devicel

Add Single Device window

NOTE: See Registration considerations for points to consider before using this registration method.

Prerequisites for registering a single device
Verify that the following conditions exist before registering a device:l

The user (local or LDAP) associated with the device must be available for selection at the time ofregistration.

lUser Portal role must be assigned to the user.

l

The following information must be available for the device:oPhone number (if any)oCountryoPlatform

Registering a single device
For most platforms, this registration method results in user notification by SMS and email. PDA users are notified
by email. The SMS contains a live URL link. The email includes a URL, instructions, and the information the user
will need to enter during registration. The user can click the live URL in the SMS or enter the URL directly into thedevice browser to complete the registration process.
If the user does not respond within 48 hours, MobileIron sends a reminder. After 120 hours, the registration expires.
This expiration interval is configurable in Settings > System Settings > Users & Devices > Registration in thefield Passcode Expiry. The maximum value is 4320 hours (6 months).
You can register devices using temporary passwords.
Procedure
1. From the Admin Portal, go to Devices & Users > Devices.
2. Click Add > Single Device.
3. Modify one or more of the following fields, as necessary.
4. Refer to the Add Single Device Fields table for details.
5. Click Register.
After a brief pause, a pop-up window lists instructions for the next step. The content of this pop-up
window varies based on the OS and type of the device. Consider leaving this message displayed until
the registration has been completed. Note that the instructions also appear in the log.

Getting Started with MobileIron Core 11.0.0.0| 76

Add Single Device window

Add Single Device window
The following table summarizes fields and descriptions in the Add Single Device window:

TABLE 16. ADD SINGLE DEVICE FIELDS
FieldsDescription

User

Enter user information to locate the user account. For example, you might enter theuser ID, first name, last name, or email address. Select the user you want to workwith from the drop-down list of matching accounts.
NOTE: You can restrict single device registration queries to users within an
LDAP OU. If there is an LDAP OU or group included in the Space
criteria, the Devices & Users > Devices > Add Device > User field will
be constrained to that OU.

Device Platform

Select the name of the operating system used on this phone.
If you do not see the platform you want, it may be disabled. For details, see thesection, “Specifying eligible platforms for registration” in the MobileIron Core Device
Management Guide.

This device has nophone number.

If you do not have a cellular operator for the device or a data plan with your current
operator, select This device has no number.

Country

Select one of the supported countries from the drop-down list. Selecting the correct
country populates the Country Code field. If the country you need is not displayed,
you may need to alter the default country list. Select Settings > System Settings> Users & Devices > Registration.

Operator

Select the name of the mobile service operator for this phone. If you selected a
country having a country code other than 1, then this field is hidden.
NOTE: You can determine whether an operator is displayed in the list by
selecting Services > Operators.

MobileEnter the phone number for the device. Your selection from the Country list will
populate the Country Code field. Enter the prefix and number without spaces,
dashes, leading zeros, or parentheses.
For example, you would enter a typical US phone number as 4085555555. You
would enter a typical UK phone number as 7889524526.

Device Ownership

Select Company if this phone is owned by the enterprise. Select Employee if thisphone is owned by the user. Note that MobileIron automatically assigns default
labels based on ownership. For details, see the section Using labels to establish
groups.

Device Language

To communicate with the device user in a language other than the default language,
select a language from the drop-down list. Languages must first be enabled under
Settings > System Settings > General > Language. If the device reports a locale
associated with a different language, then the language associated with the locale

Getting Started with MobileIron Core 11.0.0.0| 77

Add Single Device window

TABLE 16. ADD SINGLE DEVICE FIELDS (CONT.)
FieldsDescription
will be used.
Supported languages are:Include Registration
PIN only for Android
Company-Owned
Device Enrollment

lde - GERMANlen - ENGLISHles - SPANISHlfr - FRENCH

lit - ITALIANlja - JAPANESElko - KOREANlnl - DUTCHlpl - POLISHlpt - PORTUGUESElro - ROMANIANlru - RUSSIANlsk - SLOVAKlzh - CHINESE (Default)lzh_tw - CHINESE (Taiwanese)

If you selected Android in the Device Platform field, the Include Registration PIN
only for Android Company-Owned Device Enrollment field activates. Select thischeck box to enable PIN-based enrollment for Android Company-Owned Devices.
Core will prompt the device user to enter the registration PIN sent by theadministrator.
For more information, see "Registering Android devices" in the MobileIron Core
Device Management Guide for Android and Android enterprise Devices.

User Notification

l

l

l

Email: Clear this check box if you do not want the user to receive email
concerning registration status. For example, if you are in possession of thephone, and notifying the user about registration activities is not necessary,then clear this option. Select this option if the device is in the owner’s
possession.
SMS: This option is disabled by default. Select the check box if you want tosend SMS messages to devices upon registration. If set to true, the device
must have a phone number registered with MobileIron Core.
Include Registration PIN only for Apple Device Enrollment: This
option is only available when selecting iOS or macOS as the device
platform. Select to enable PIN-based Apple Device Enrollment for the

Getting Started with MobileIron Core 11.0.0.0| 78

Bulk device registration

TABLE 16. ADD SINGLE DEVICE FIELDS (CONT.)
FieldsDescription
device. Core will prompt the device user to enter their username and a PIN.
For more information about anonymous DEP enrollment, see “Creating
Apple Device Enrollment profiles” and “Assigning Apple Device Enrollment
devices to an enrollment profile en masse” in the MobileIron Core Device
Management Guide for iOS and macOS Devices.

Related topics
Bulk device registration

Bulk device registration
Admins can register a large group of devices using a CSV file that contains the information required for bulk
registration. This method is best for the following scenarios:lAdding a large number of deviceslRolling out multiple devices into a production environmentlUsing web-based registration (for details, see “Web-based registration for iOS and macOS devices” in the
MobileIron Core Device Management Guide for iOS.)

After the registration CSV file has been imported, Core completes the following tasks:lCreates specified local user accounts, if they do not already exist.

lFinds specified LDAP user accounts.

lInitiates the registration process.

This section contains the following topics for bulk registration:lPrerequisites for bulk device registrationlRegistering multiple deviceslBulk device registration CSV file requirements

NOTE: See Registration considerations for points to consider before using this registration method.

Prerequisites for bulk device registration
Verify that the following conditions exist before using bulk device registration:l

LDAP users specified in the CSV file must be available for selection. Local users that have not beencreated already will be created as part of the Bulk Registration process.

Getting Started with MobileIron Core 11.0.0.0| 79

Registering multiple devicesl

The User Portal role must be assigned to the users.

l

The following information must be available for the device:ophone number (if any)ocountryoplatform

You can register devices using temporary passwords.
NOTE: MobileIron Core does not support creating both a bulk enrollment record and a single device
record for the same user. Only a bulk enrollment or a single add device enrollment should be
used for a user, not both.
Refer to Bulk device registration CSV file requirements for details on how to create a CSV file to use for bulk
registration.

Registering multiple devices
For most platforms, the bulk registration method results in user notification by SMS and email. PDA users arenotified by email. The SMS contains a live URL link. The email includes a URL, instructions, and the information
the user will need to enter during registration. The user can click the live URL in the SMS or enter the URL directly
into the device browser to complete the registration process.
If the user does not respond within 48 hours, MobileIron sends a reminder. After 120 hours, the registration expires.
This expiration interval is configurable in Settings > System Settings > Users & Devices > Registration in thefield Passcode Expiry. The maximum value is 4320 hours (6 months).
Procedure
1. From the Admin Portal, go to Devices & Users > Devices.
2. Click Add > Multiple Devices to open the Adding Multiple Devices window.
3. Use the Browse button to select the CSV file containing the bulk registration data.
You can also select the Sample CSV File button in the to start with a sample file and input the content.
Refer to the fields in the Bulk device registration CSV file requirements for details.
NOTE: If an LDAP OU or Group is part of the Space criteria, the users in the comma-separated
values (CSV) file will be matched against it. From the Devices & Users > Devices > Add
Multiple Devices menu, enter a CSV file and click Apply to see the restricted list of users. If
the user isn’t in the OU or group, “User not found” displays in the Message column for thatuser.
4. Click Import File > Apply.
5. Review the status columns to confirm that each entry was successfully imported.
6. If any items failed, scroll to the right and hover over the Message column to display more information.

Getting Started with MobileIron Core 11.0.0.0| 80

Bulk device registration CSV file requirements

Bulk device registration CSV file requirements
Note the following requirements when entering your bulk registration content into a CSV file:lLocal user IDs cannot contain spaces. Spaces are allowed for LDAP users.

l

The Platform field is case sensitive. Enter only uppercase letters in this field.

lPhone numbers cannot contain spaces or non-numeric characters.

lMaximum recommended number of device entries per spreadsheet is 2000. Bulk device registration could
fail when using a comma-separated values (CSV) file with more than 2000 device entries.

Each line in the file must contain the following fields, separated by tabs or commas, in the following order.

TABLE 17. FIELDS IN THE BULK DEVICE REGISTRATION CSV FILE
FieldsDescription

User ID

Specifies the user ID for either an existing local user, a local user to be created, oran LDAP user that can be looked up as an LDAP user on the configured LDAP
server. Spaces are not supported for local users.
Example: jdoe

Country CodeSpecifies the country code corresponding to the phone number.
For PDAs, such as the iPod touch, enter 0 in this field.
Example: 1

NumberSpecifies the phone number (without country code.)
For PDAs, such as the iPod touch, enter PDA.
Example: 4085551212

Operator

Specifies the service provider name. This field is not required for PDAs, such as theiPod touch, or for countries having a country code other than 1. See Services >Operators for a list. If the operator does not appear in this list, contact MobileIron
Technical Support.
Example: Sprint

OS

Specifies a character indicating the operating system. Use the following character:l

A: Androidl

I: iOSl

L: macOSl

E: Windows and Windows Phone

Entries are case sensitive.
If the specified platform has been disabled for registration, then the registration will
fail. For details, see the section “Specifying eligible platforms for registration” in the
Device Management Guide.

Getting Started with MobileIron Core 11.0.0.0| 81

Bulk device registration CSV file requirements

TABLE 17. FIELDS IN THE BULK DEVICE REGISTRATION CSV FILE (CONT.)
FieldsDescription
Example: A

E/CSpecifies phone ownership. Use the following characters:l

C: Companyl

E: Employee

Example: C
SourceSpecifies the identity source of the user name. Use the following characters:l

D: Directory (LDAP)l

L: Local

Entries are case sensitive.
Example: DFirst Name

If the Source field contains “L”, provide the user’s first name.
Example: John

Last Name

If the Source field contains “L”, provide the user’s last name.
Example: DoeEmail

If the Source field contains “L”, provide the user’s email address.
Example: jdoe@mycompany.com

Password

Specifies the password to set for a new local user account. If you do not intend touse this field or the user is an LDAP user, then you can leave it blank.
Example: p@$sW0rd

Device Language

Optional. Specifies the language to use for communicating with the device user if
the device has not reported its locale.
lde - GERMANlen - ENGLISHles - SPANISHlfr - FRENCH

lit - ITALIANlja - JAPANESElko - KOREANlnl - DUTCHlpl - POLISH

Getting Started with MobileIron Core 11.0.0.0| 82

Bulk device registration CSV file requirements

TABLE 17. FIELDS IN THE BULK DEVICE REGISTRATION CSV FILE (CONT.)
FieldsDescriptionlpt - PORTUGUESElro - ROMANIANlru - RUSSIANlsk - SLOVAKlzh - CHINESE Simplified (Default)lzh_tw - CHINESE Traditional (Taiwanese)

Example: ja-JP
User Display Name

Optional. Specifies an alternate name used to identify the device user. If you leavethis field blank, then the display name will have the following format:
Firstname Lastname
Example: Smith, Ken

Notify User

Specifies whether to send an email concerning registration status to device users.
For example, if you are in possession of the phone, and notifying the user about
registration activities is not necessary, then set this option to FALSE. Specify
TRUE if the device is in the owner’s possession.

Serial Number

Lists device serial numbers.

Getting Started with MobileIron Core 11.0.0.0| 83

Tracking registration status

TABLE 17. FIELDS IN THE BULK DEVICE REGISTRATION CSV FILE (CONT.)
FieldsDescription

Notify User by SMS

Optional. Specifies whether to send an SMS regarding registration status todevices. Set this option to FALSE if you are in possession of the device, or if
sending bulk SMS messages would be too costly. Set to TRUE if you want to notify
device users of their registration status via SMS. If set to true, the device must havea phone number registered with MobileIron Core.
This field is enabled by default.

Include Apple Device
Enrollment Only
Registration Pin(TRUE or FALSE)

For iOS and macOS devices only.
Specifies whether to enable PIN-based, anonymous enrollment using Apple Device
Enrollment.
For more information about anonymous Apple Device Enrollment, see “Creating
Apple Device Enrollment profiles” and “Assigning Apple Device Enrollment devices
to an enrollment profile en masse” in the MobileIron Core Device Management
Guide for iOS Devices.

Include Android
Corporate Device
Enrollment Only

For Android devices only.
Specifies whether to enable PIN-based registration enrollments for Android
Corporate devices.

Registration Pin(TRUE or FALSE)

For more information, see "Registering Android devices" in the MobileIron Core
Device Management Guide for Android and Android enterprise Devices.

Tracking registration status
You can track the registration status of each device.
Procedure
1. From the Admin Portal, go to Devices & Users > Devices page to view the state of each device.
lllPending: the device has been registered on the MobileIron Server, but the Mobile@Work app(Apps@Work for Windows) download has not yet been completed.
Verified: the user has confirmed that the download of Mobile@Work app (Apps@Work for Windows)
should proceed.
Active: the Mobile@Work app (Apps@Work for Windows) has been successfully downloaded andconnected back to MobileIron Core at least once.

l

Lost: the device has been manually marked as Lost. This status does not affect other functionality.

l

Wiped: the device has been restored to factory defaults.

NOTE: Mobile@Work cannot be installed to macOS devices.

Getting Started with MobileIron Core 11.0.0.0| 84

Restricting the number of devices a user registers

Restricting the number of devices a user registers
You can set and enforce a device limit for your users. For example, if the limit is three devices, Core prevents auser from registering a fourth device. The benefits to setting a device limit in MobileIron Core:lensure resources, such as licenses, are available for all userslprevents misuse of resourceslenforces the corporate device limit automatically, without the need to check each user one-by-one.

Modifying the number of devices users can register
Use this procedure to restrict the number of devices users can register at a time or remove all restrictions.
Procedure
1. From the Admin Portal, go to Settings > System Settings > Users & Devices > Registration.
2. In Per-User Device Limit, enter the number of devices each user can register.
lSpecify a limit from 1 to 50 devices.

l

Leave the box blank, the default value, to indicate no limit.

3. Click Save.

Restricting device registration by enrollment type
You can restrict which devices register with MobileIron Core based on how the devices were initially enrolled.
Procedure
1. On the Admin Portal, go to Settings > System Settings > Users & Devices > Device Registration.
2. Select the check box for Restrict device registrations by enrollment type.
Additional options are now available to select.
3. Select one or more of the following enrollment types:lApple devices that are part of the Automated Device Enrollment ProgramlAndroid devices that are part of the Google Zero TouchlAndroid devices that are part of Samsung Knox Mobile Enrollment

4. Click Save.
Only devices enrolled using the selected enrollment method can register with MobileIron Core.
Deselecting Restrict device registrations by enrollment type removes the restriction.

Getting Started with MobileIron Core 11.0.0.0| 85

Registration considerations

Registration considerations
This section describes features and dependencies to consider before registering devices, organized by operating
system.
l

Registration considerations: Androidl

Registration restrictions for Androidl

Registration considerations: iOS and macOSlRegistration considerations: Windows

Registration considerations: Android
Following is a list of registration considerations for Android devices.
l

l

l

l

l

l

l

l

Administrators will need to decide on whether they are supporting password, registration PIN or both fordevice registration.
Registration currently depends on acquiring the MobileIron client app (Mobile@Work) from the Google Play
store.
For devices that cannot access Google Play, provide another way for the device users to get the
Mobile@Work for Android app. For example, email the app to the device users. You can also place the app
on a website and provide the URL to the device users.
Configuring the Server Name Lookup preference (in the Admin Portal under Settings > System Settings,
in the Users & Devices > Device Registration page) makes registration easier by automatically filling inthe server address for the user. Note that the administrator must initiate registration or invite the user toregister. Contact Customer Support to register your server.
If you have configured a MobileIron Sentry to support Android devices connecting via ActiveSync, then
you can initiate registration from the ActiveSync Devices screen.
By default, the user is required to enter a password to register the device. If you prefer, you can change thisbehavior to require a MobileIron-generated Registration PIN instead, or to require both a password and a
Registration PIN. See the section, “Configuring user authentication requirements for registration” in the
Device Management Guide for information on specifying behavior for this feature.
Enroll with Android enterprise. ndroid enterprise enables devices to have separate private and work profiles
in BYOD deployments, and enables administrators to have more control over enterprise owned andprovisioned devices. For details on enrolling in Android enterprise see, MobileIron Core Device
Management Guide for Android for Work.
When an app is hidden it can be used by other apps, but not available to launch in the kiosk. For example, abrowser can be added to the kiosk but hidden so that it can be used to open URLs from an email app

Registration restrictions for Android
When performing bulk registration of Android devices, you can restrict the OS version as well as the minimum
security patch level. Also, you can set a manufacturer's Whitelist or Blacklist and set a minimum SafetyNet
certification to enforce SafetyNet attestation. For more information about SafetyNet Attestation, see "Enabling

Getting Started with MobileIron Core 11.0.0.0| 86

Registration restrictions for Android

SafetyNet Attestation on Android Devices" in the MobileIron Core Device Management Guide for Android andAndroid enterprise Devices.
NOTE: When placing registration restrictions on Android devices, use Mobile@Work for Android 10.3.0.0
through the most recently released versions as supported by MobileIron for the optimum user
experience.
To access the registration restriction fields for Android, go to Settings > System Settings > Users & Devices >Device Registration and scroll down to the "Restrictions for Android" heading. The following fields restrict device
registration on Android devices.

TABLE 18. REGISTRATION RESTRICTIONS FOR ANDROID DEVICES
Item

Description

Default Policy
Setting

Minimum OS
VersionUse the pull-down menu to set the minimum Android OS version thatcan run on a registered Android device.

No Setting

Minimum Security
Patch Level

Specify the minimum number of days a security patch level is active
by using the pull-down menu.

No Setting

Manufacturer
Whitelist/Blacklist

Restrict the Android manufacturers that can be configured as Android
devices. Select from the following:

None

None: This is the default value. It sets neither whitelist nor blacklist
registration restrictions.
NOTE: For both the Create a Whitelist and Create a Blacklist
fields, the Manufacturer names are case sensitive.
Create a Whitelist: Allows only devices from specific manufacturers
to register as Android devices. Select the check box and then the
Manufacturer Name menu is displayed. Use the Add+ button to add
the names of one or more manufacturer. Also, Manufacturers who are
not specified by this field are block from registering as Android
devices.
Create a Blacklist: Prevents devices from specific manufacturers
from registering as Android devices. Select the check box and thenthe Manufacturer Name menu is displayed. Use the Add+ button to
add the names of one or more manufacturers.
Minimum
SafetyNet
Certification

Set a required minimum SafetyNet certification level for registering
Android devices. If you enable this field, you must also enable
SafetyNet Attestation in the default security policy for the devices.

None

None: It sets no minimum SafetyNet certifications for registration.
This is the default value.
basic: Select to allow only devices with a basic SafetyNet
certification from registering as Android devices.
certified: Select to allow only devices with a certified SafetyNet
certification from registering as Android devices.

Getting Started with MobileIron Core 11.0.0.0| 87

Registration considerations: iOS and macOS

Registration considerations: iOS and macOS
Following is a list of registration considerations for iOS or macOS devices.
l

l

l

l

l

l

l

l

l

l

Administrators will need to decide on whether they are supporting password, registration PIN or both fordevice registration.
If you are registering a device with the MobileIron client app, Mobile@Work, you must use an iTunes
account to download the app from the iTunes App Store. A credit card is not needed to establish an iTunes
account. Simply download Mobile@Work, click Create New Account, and select None as your payment
method.
If you have configured a MobileIron Sentry to support iOS devices connecting via ActiveSync, then you
can initiate registration from the ActiveSync Devices screen.
By default, the user is required to enter a password to register the device. If you prefer, you can change thisbehavior to require a Core-generated registration PIN instead, or both a password and a registration PIN.
See the section, “Configuring user authentication requirements for registration” in the MobileIron Core
Device Management Guide for iOS, to specify the behavior for this feature. Registration PINs are notsupported for iOS managed apps.
For MDM-enabled iOS devices, MDM features are not dependent on Mobile@Work after registration.
Therefore, if a user uninstalls the Mobile@Work, features like app inventory will continue to function.
If you need to register many macOS or iOS devices on behalf of users, such as when Macs or iPhones arepurchased by the corporation and rolled out in bulk, depot-style registration may be preferable. See “Webbased registration for iOS and macOS devices” in the MobileIron Core Device Management Guidefor iOS.
Consider an extra security option if you are including Mobile@Work for iOS in the MobileIron Core App
Catalog and sending an installation request to devices after device users complete registration, such aswith web-based registration. In this case, users do not have to reenter their credentials when they launch
Mobile@Work. However, you can limit this silent registration with Mobile@Work to one time only. In the
Admin Portal, go to Settings > System Settings > Users & Devices > Device Registration and selectAllow silent in-app registration only once. (iOS only).
In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, a dialog box
displays requesting device users to enable tracking when the Mobile@Work app is running. Mobile@Work
opens iOS Settings where device users can choose "Ask Next Time" or "Never". MobileIron recommends
device users to enable tracking. This change applies to all versions of iOS 13 through the latest version as
supported by MobileIron. Mobile@Work for iOS does not track device users' location without consent.
You can register an Apple TV to MobileIron Core only through the Apple Configurator. See “Registering an
AppleTV” in the MobileIron Core Device Management Guide for iOS and macOS Devices.
For registering users and devices for Apple Education Manager and Apple Business Manager, see the
MobileIron Core Device Management Guide for iOS and macOS Devices

Registration considerations: Windows
Following is a list of registration considerations for Windows devices.
ll

The Apps@Work app is installed for Windows Phone 8.1 as part of the registration process.
To register Windows 10 devices, open Settings > Accounts > Your Workplace > Connect toWorkplace.

Getting Started with MobileIron Core 11.0.0.0| 88

Registration considerations: Windowsl

MobileIron Sentry is required for the available device management features.
NOTE: These devices do not have device management features. However, these devices can
sync using Exchange ActiveSync and be managed using ActiveSync policies.

l

l

l

l

Single device registration, bulk registration, and invitations to register are supported for all available
Windows devices.
Registration of the all available Windows device is done through the Windows native client.
Device registration fails if the device user enters a password that contains UTF-8 characters. Only ASCII
characters are supported in the password field.
If auto discovery is not set up, the registration process requires the device user to enter the VSP server
address (FQDN). The device user will also have to enter the VSP server address when logging into
Apps@Work for the first time.

lA root or intermediate certificate from a trusted certificate authority (CA) is required.

l

The User Portal role is required for the user to register with MobileIron Core.

lSingle device registration, bulk registration, invitations to register are supported.

lRegistering your Windows Phone device 8.1 in the User Portal is supported.

l

Select Windows as the device platform.

l

l

l

l

l

l

l

Reprovisioning the device is not supported. To re-provision the device, first retire the device, then reregister.
Device registration fails if the device user enters a password that contains special characters. Only ASCII
characters are supported in the password field.
Force Device Check-In may not be available for a few minutes after the Windows Phone 8.1 device
registers. If you try to retire the device during this time, it may take up to 24 hours to retire the device.
MobileIron certificates pushed to Windows 8.1 Phone devices are now always stored on the device TPM
chip. This provides additional security to the certificate key.
Autodiscovery is not required. We recommend autodiscovery for a seamless registration experience.
A Subject Alternative Name (SAN) SSL certificate from a trusted Certificate Authority (CA), such as
Verisign or GoDaddy, is required.
Device registration from the Admin Portal or User Portal is not supported. Users can register only fromtheir device.

l

Pin-based registration is supported in Windows Phone 8.1 devices.

l

The following registration statuses are supported:oVerified: After the device registers and before the first check in.

oActive: The device has successfully synced with Core.

oRetired: The Retire action was successfully applied.

oPending: The user’s device has been registered on the MobileIron Server, but downloading
Apps@Work has not yet been completed.

Getting Started with MobileIron Core 11.0.0.0| 89

Using bulk enrollment for Android devices

Using bulk enrollment for Android devices
You can use bulk enrollment to register multiple Android devices quickly.
NOTE: See Registration considerations for points to consider before using this registration method.
Before you begin:ll

The Android SDK must be installed on the computer used to register the devices.
Enable USB debugging. For more information on USB debugging see
http://developer.android.com/tools/help/adb.html.

lInstall Mobile@Work on each device.

l

Use a USB cable to connect the devices to the provisioning computer.

Example adb shell:$ adb shell am start "mirp://www.example.com%26user=cc%26pin=316940%26quickStart=false"

Sample values include:

TABLE 19. SAMPLE VALUES FOR ADB SHELL
Key

Value

user

User name that would have been typed into the username field if using iReg.
Required.

pin

Registration Pin. Required.

quickStart••

Set to TRUE: Do not display the splash screen. The Privacy screen is not
displayed. The Apps@Work shortcut is not created. On Zebra devices, Device
Administration privileges are set automatically.
Set to FALSE: The user must tap Continue on the Welcome screen to proceed.
When quickstart is set to false the user must choose whether to accept
Apps@Work shortcut creation, must Acknowledge Privacy policy, and accept
Device Admin priviledges. Optional defaults set to FALSE.

Here is an example of a bulk enrollment script:
for i in `adb devices | grep -v devices | grep device | cut -f 1`
doecho "Registering $i"
adb shell am start"mirp://app183.auto.mobileiron.com%26user=cc%26pin=316940%26quickStart=false"done

You might receive these error messages when you use bulk enrollment.

Getting Started with MobileIron Core 11.0.0.0| 90

Using bulk enrollment for Android devices

TABLE 20. BULK ENROLLMENT ERROR MESSAGES
Error

Resolution

mirp
schemenot found

Example mirp scheme:

URL isinvalid

Occurs if no data string is sent at all. Verify that the URL is correct.

No server
information
foundServer information missing or improperly entered.

No user
information
found

Verify that user key was entered.

am start"mirp://app183.auto.mobileiron.com%26user=cc%26pin=316940%26quickStart=false"Getting Started with MobileIron Core 11.0.0.0| 91

5Using Policies
This chapter includes the following sections:l

Policy overviewlWorking with policieslUsing default policies

Refer to the Device Management Guide for advanced policy topics, such as those shown in Policy topics per
operating system .

TABLE 21. POLICY TOPICS PER OPERATING SYSTEM
Policy topic

OS

Notifications of changes to the privacy policyAlllWorking with Android Quick Setup policieslWorking with Samsung general policieslSingle-app mode policieslGlobal HTTP proxy policieslCellular policieslWallpaper policieslCustomizing a home screen layoutlCustomizing a lock screen messagelConfiguring notification settings

Android

iOS

Working with Windows Update policies

Windows

Compliance policies

Android, iOS, tvOS

AppConnect and AppTunnel

Android, iOS
For information about AppConnect and
AppTunnel, including related policies andconfigurations, refer to the MobileIron Core
AppConnect and AppTunnel Guide.

NOTE: Some features are not applicable if you use MAM-only iOS or Android devices. For more
information, see “Managing apps on MAM-only devices” in the MobileIron Core Apps@Work
Guide.

Getting Started with MobileIron Core 11.0.0.0| 92

Policy overview

Policy overview
MobileIron Core uses policies to regulate the behavior of the devices it manages. Each policy consists of a set ofrules. Core groups the policies in the following categories:l

Security policieslPrivacy policieslLockdown policieslSync policies

NOTE: For information about the AppConnect global policy, see the MobileIron Core AppConnect
and AppTunnel Guide.
MobileIron Core provides a set of default policies that you can use with little or no configuration. You can modify
default policies, but you cannot delete them. You can distribute a policy to devices by applying a policy to a label.
Core then pushes the policy to the devices assigned to that label the next time the devices sync with Core.
You can also create your own customized policies to replace or enhance the default policies included with
MobileIron Core. You can edit custom policies, but, unlike default policies, you can delete custom policies fromCore. You apply custom policies to a label to distribute them to devices. Default policies do not require label
assignment.
MobileIron Core allows you to apply a label to multiple policies of a given category. For example, you can assign
two custom security policies to the same label. However, Core only uses one security policy per device. Thismeans that you need to prioritize the use of custom policies if you distribute to devices more than one policy of agiven category.
Policy prioritization allows you to specify which policy should be used first if you have more than one policy of agiven type associated with a label. For example, if you create two custom security policies, and apply the iOS label
to both custom policies, you can configure custom security policy A to take precedence over custom security
policy B.

Working with policies
You can create multiple policies for each policy type, but only one active policy of each type can be applied to a
specific device. Use the Policies page to specify and control aspects of enterprise device behavior. To distributethe policy to devices, apply your policy to the relevant labels.
This section includes the following topics:l

Accessing the Policies pagel

Modifying an existing policylCreating a custom policy

Getting Started with MobileIron Core 11.0.0.0| 93

Accessing the Policies pagelDeleting a policylApplying policies to labelslRemoving policies from labels

Accessing the Policies page
You can create multiple policies for each policy type, but only one active policy of each type can be applied to a
specific device. Use the Policies page to specify and control aspects of enterprise device behavior.
Users must have one of the following roles to access the Policies page:lView policieslApply and remove policy labellManage policy

Procedure
1. From the Admin Portal, go to Policies & Configs > Policies.
2. Refer to the Policy page table table for details.

Policy page table
The following table summarizes fields and descriptions in the Policies window.

TABLE 22. POLICIES PAGE TABLE
FieldsDescription

Policy Name

Identifier for this policy. The policy name must be unique for policies of the same
type.

Priority

Priority set for this policy in relation to other policies of the same type.

StatusCurrent status of this policy. The status can be Active or Inactive.

Description

Additional information about the policy that you entered when you created thepolicy.

Type

Which policy category this policy belongs to.

Last Modified

The date and time of the last change made to this policy.

Getting Started with MobileIron Core 11.0.0.0| 94

Modifying an existing policy

TABLE 22. POLICIES PAGE TABLE (CONT.)
FieldsDescription# Phones

The number of devices affected by this policy. Click the link to display a list of thedevices.

LabelsThe labels applied to this policy.

WatchList

Exception: Backup & Restore policies are not distributed to the Mobile@Work
client app. In this case, the WatchList column indicates the devices that are
awaiting backup.
Displays the number of devices for which the policy is queued. Click the link todisplay a list of the devices.

Modifying an existing policy
You can edit an existing default or custom policy in the Admin Portal.
NOTE: When changing a policy, devices with the changed policy applied may prompt users to restart
their devices.
Procedure
1. From the Admin Portal, go to Policies & Configs > Policies.
2. Click a policy in the Policy Name column to open the Policy Details pane on the right of the window.
3. Click the Edit button to open the Modify Policy window for the policy type you selected.
4. Refer to following sections as a guide for each policy type.
l

Security policieslPrivacy policieslLockdown policieslUsing default policieslAppConnect global policy: see the MobileIron Core AppConnect and AppTunnel Guide for more
information.

5. Click Save.
NOTE: Policies do not take affect on any device until they are applied to a label. See Applying policies
to labels for details.

Creating a custom policy
While you can edit the default policies provided by MobileIron Core, you can also create your own custom security,
privacy, lockdown, or sync policy.

Getting Started with MobileIron Core 11.0.0.0| 95

Prioritizing policies

Procedure
1. From the Admin Portal, go to Policies & Configs > Policies.
2. Click Add New and select a policy type you want to create.
3. Refer to following sections as a guide for each policy type.
l

Security policieslPrivacy policieslLockdown policieslUsing default policies

NOTE: See the MobileIron Core AppConnect and AppTunnel Guide for more information
regarding the AppConnect global policy.
4. Click Save.
NOTE: Policies do not take effect on any device until they are applied to a label. See Applying policies
to labels for details.

Prioritizing policies
When you create a custom policy, you can assign a priority relative to the other custom policies of the same type.
This priority determines which policy is applied if more than one policy is associated with a specific device. For
example, if you create a security policy for executives and a security policy for Windows devices, then an
executive with a Windows device would have two different possible policies applied. Because only one policy of agiven type can be applied to a device, the priority defined for the policies determines which is applied.
You can manage priorities for individual policies, or you can use the Modify Priority screen to manage priorities fora policy type in a single screen.
To manage priorities in a single screen:
1. Go to Policies & Configs > Policies.
2. Select a type from the Policy Type drop-down.
3. Click Modify Priority. The Modify Policy Priorities dialog appears.
4. Drag and drop policies until they reflect the priorities you want to set, with highest priority of 1 appearing at
the top of the list.
5. Click Save.

Getting Started with MobileIron Core 11.0.0.0| 96

Displaying custom policies for a selected label

Displaying custom policies for a selected label
To display a list of the policies associated with a specific label:
1. Go to a policies page under Policies & Configs.
2. Select a label from the Labels drop-down list.
NOTE: Default policies are not included.

Displaying custom policies for a selected user
To display a list of the policies associated with a specific user:
1. Go to a policies page under Policies & Configs.
2. In Search by User, enter any portion of the user’s first name, last name, or user ID and click the searchicon. Policies assigned to user records matching the entered criteria are displayed.
NOTE: Default policies are included. See Using default policies.

Deleting a policy
When you delete a policy, all devices to which that policy were applied are updated with the default version of thatpolicy. You cannot delete a default policy.
Procedure
1. From the Admin Portal, go to Policies & Configs > Policies.
2. Click one of the filters under the Policies & Configs tab to display the policy you want to delete.
3. Select the check box for the policy you want to delete.
4. Click Delete in the upper left.

Applying policies to labels
Use labels to apply policies to devices.
Procedure
1. Log into the Admin Portal.
2. Select Policies & Configs > Policies.
3. Click a policy in the Policy Name column to display the policies you want to work with.
4. Select the check box next to the policy.
You can search by policy name or description to help find the policy or policies you want to apply.
5. Click More Actions > Apply To Label.
6. Select the label.

Getting Started with MobileIron Core 11.0.0.0| 97

Removing policies from labels

You can search by label name or description to help find the label.
7. Click Apply.

Removing policies from labels
You can remove a policy from a label when you no longer want changes to that policy to affect devices having agiven label.
Procedure
1. From the Admin Portal, select Policies & Configs > Policies.
2. Click a policy in the Policy Name column to display the policies you want to work with.
3. Select the check box next to the policy.
4. Click More Actions > Remove From Label.
5. Select the label.
6. Click Remove.

Using default policies
Default policies are the policies applied to a device automatically when it is registered. Default policy values arealso used as a starting point when you create a custom policy. MobileIron provides the values for each default
policy specification. It is recommended that you create your own policies. You can use the settings in the default
policies as a starting point. If you do edit a default policy’s values (not recommended), those new values become
the starting point when you create a new custom policy.
A device can have only one policy of each type.
MobileIron provides defaults for the following policy types:lSecurity policieslPrivacy policieslLockdown policieslSync policies

NOTE: You cannot delete default policies.
For information about:l

AppConnect global policy, refer to the MobileIron Core AppConnect and AppTunnel Guide.

l

AppConnect and AppTunnel, refer to the MobileIron Core AppConnect and AppTunnel Guide.

Getting Started with MobileIron Core 11.0.0.0| 98

Security policies

Security policies
Security policies specify how MobileIron addresses several areas of mobile security. Use the following guidelines
to create or edit a Security policy. MobileIron recommends you create separate policies for each platform to avoid
inconsistencies.
NOTE: Access control for macOS devices does not control email.
The following table summarizes fields and descriptions in the Security Policy window.

TABLE 23. SECURITY POLICY FIELDS
Item

Description

Default Policy
Setting

Name

Required. Enter a descriptive name for this policy. This is the
text that will be displayed to identify this policy throughout theAdmin Portal. This name must be unique within this policy type.

Default Security
PolicyTip: Though using the same name for different policy types isallowed (e.g., Executive), consider keeping the names unique toensure clearer log entries.
StatusSelect Active to turn on this policy. Select Inactive to turn off
this policy.

ActiveTip: Use the Status feature to turn a policy on or off across allphones affected by it. The policy definition is preserved in case
you want to turn it on again.
Priority

Specifies the priority of this custom policy relative to the othercustom policies of the same type. This priority determines which
policy is applied if more than one policy is associated with a
specific device. Select “Higher than” or “Lower than”, thenselect an existing policy from the drop-down list. For example, togive Policy A a higher priority than Policy B, you would select“Higher than” and “Policy B”.
Because this priority applies only to custom policies, this field is
not enabled when you create the first custom policy of a given
type.

Description

Enter an explanation of the purpose of this policy.

Default Security
PolicySelect Mandatory to specify that the user must enter apassword before being able to access the device. Otherwise,
select Optional, which allows the user to determine whether the
password will be set.

Optional

Password
Password

Getting Started with MobileIron Core 11.0.0.0| 99

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

NOTE: If you intend to use the Lock feature in case thephone is lost or stolen, then a password must be seton the phone. Therefore, specifying a mandatory
password is strongly advised.
For iOS, tvOS, and macOS devices:
Select Mandatory to specify that the device user must comply
with the password policy when resetting the password for thedevice. This does not force a user to change an existing
password.
For iOS devices:
If a security policy is edited and the Password field is set to
Optional, then the security policy will not be pushed to devices.
This results in an inaccurate count in your WatchList on the
Policies & Configurations > Policies page. MobileIron recommends you have the Password field set to Mandatory.
Password TypeSpecify general restrictions for the password:

Don’t Care

Simple: Determines whether a simple password is allowed. A
simple password can contain repeated characters, or
ascending/descending characters, for example 123 or CBA.
Alphanumeric: Requires passwords to include at least one
letter and one number.
For iOS, tvOS, and macOS: If you select both Simple andAlphanumeric, then passwords can include repeating and/or
ascending/descending characters. If you select Alphanumeric
only, then passwords may not include repeating and/or
ascending/descending characters.
Don’t Care: Applies the default requirements specified by thedevice OS. This option is not supported on iOS.
NOTE: If no check box is selected, the Password Typedefaults to Don’t Care.
For Windows Phone 8.1 devices: The Don’t Care option
requires that the password is either simple or alphanumeric.
To allow the use of a PIN, but not a simple password such as1234 or 1111, select the Don’t allow simple password option.
For Windows 10 Mobile devices: This feature is notsupported. Use Minimum Number of Complex Characters tomake changes to these keyboards.

Getting Started with MobileIron Core 11.0.0.0| 100

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Complex PIN(Android only)

For Android devices only:

Off

Select On to prohibit the device user from using ordered orrepeating digits in a PIN.
This option is enabled only if:lthe password is mandatorylthe password type is simple only

Examples of ordered digits: 1234, 2468, 9876
Example of repeating digits: 4444
This feature requires Android 5.0 through the most recently
released version as supported by MobileIron. Devices runningearlier versions behave as if this option is set to Off.
Minimum
Password Length

Enter a number between 1 and 16 to specify the minimum length
for the password. Leave this setting blank to specify no
minimum.

6

Note: For Android devices: When the Don't Care option is set
for the Password Type field, the Minimum Password Length
field does not apply.
Maximum
Inactivity Timeout

Select the maximum amount of time to allow as an inactivity
timeout. To disable this feature, select Never. The user can thenspecify up to this value as the interval after which the screen
locks.

30 minutes

For macOS: Enter the maximum timeout interval that the deviceuser can set for the device before the screen saver engages.
For iOS and tvOS: The Grace Period for Device Lock option
determines whether the user must enter a password to unlock
the screen. Also consider the case when the maximum
inactivity timeout that you specify is greater than the maximum
inactivity timeout that the device supports. In this case, theinactivity timeout that the user can specify is limited by thedevice’s maximum inactivity timeout.
For Windows Phone 8.1 and Windows 10 Mobile devices: If
the Maximum Inactivity Timeout is set to one minute, thedevice uses the timeout set on the device.
Minimum Numberof Complex
Characters

For iOS, tvOS, and Android: Specify the minimum number of
special characters that must be included in a password.

0

For Windows Phone 8.1 devices: Specify the minimum level

Getting Started with MobileIron Core 11.0.0.0| 101

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Settingof complexity, 1 to 4, required in a password. The values indicate
the minimum number of character types required. The charactertypes are lowercase, uppercase, numbers, and nonalphanumeric.
For Windows 10 Mobile devices: The complexity will
determine what type of password and keypad the user sees.
1 - Digits only (the default)
2 - Digits and lowercase letters are required
3 - Digits, lowercase letters, and uppercase letters are required
4 - Digits, lowercase letters, uppercase letters, and special
characters are required.
For Windows 10 Desktop devices: This feature is notsupported.
Maximum
Password Age

For Windows Phone 8.1 devices: This feature is notsupported.

0

For Windows 10 devices: Specifies when the password
expires (in days).
NOTE: This policy must be wrapped in an Atomic
command.
Supported values are listed below:
An integer X where 0 <= X <= 730.
0 (default) - Passwords do not expire.
If all policy values = 0 then 0; otherwise, Min policy value is themost secure value.
For iOS, macOS, tvOS, and Android: Specify the numbers ofdays after which the password will expire. 0 indicates no limit.
NOTE: Mobile@Work 10.1.0.0 for Android through the mostrecently released version as supported by
MobileIron provides the device user a notification
when the password is going to expire within thenext 7 days.
For more information, see "Setting an alert that a device's PIN
change request was skipped" in MobileIron Core Device
Management Guide for Android and Android enterprise Devices.
Maximum

This feature does not apply to Windows devices.

0 (no limit)

Getting Started with MobileIron Core 11.0.0.0| 102

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Number of Failed
Attempts

Specify the maximum number of times the user can enter anincorrect password before the device is wiped. 0 indicates nolimit.
For Android and Android enterprise devices:
When set to zero, unlimited passcode failures are allowed. Whenset to anything greater than zero only the number of consecutive
failures specified are allowed.
For iOS and tvOS:
When set to a maximum number of 3 or less, the device
imposes a time delay before a passcode can be entered again.
The time delay increases with each failed attempt, as shown in
the following table.

For example, if the device user has failed to enter the correct
password for the 7th time, a wait time of 5 minutes is imposed,
for a total wait time of 6 minutes, even when the maximum
number of failed attempts has been set to 3.
When set to 4 or above, devices that can no longer be disabled
by users are wiped when entering the fifth incorrect passcode.
There is no wait time in this case.
When set to 3 or less, and enabling the iOS or tvOS setting toerase the device after too many failed passcode attempts (under
Settings > Touch ID & Passcode > Erase Data in iOS), thedevice is wiped when entering the 11th failed passcode.
NOTE: If there is no passcode set on the device, dataprotection is disabled by default. This is as per

Getting Started with MobileIron Core 11.0.0.0| 103

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
SettingApple design.
Password History

For Android, iOS, tvOS, and macOS devices:

0

Specify the number of passwords remembered to ensure thatusers define a different password.
For example, if you want to prevent users from repeating apassword for the next four password changes, enter 4.
Maximum
Number of Failed
Attempts

For Windows Phone 8.1 devices: If this is set as 1, the user is
not prompted to enter the device password.
For all Windows 10 devices: This feature specifies the numberof authentication failures allowed before the device will be wiped.
A value of 0 disables device wipe functionality.
NOTE: This policy must be wrapped in an Atomic
command.
Prior to reaching the failed attempts limit, the user is sent to thelock screen and warned that more failed attempts will lock their
computer. When the user reaches the limit, the device
automatically reboots and shows the BitLocker recovery page.
This page prompts the user for the BitLocker recovery key.
The following list shows the supported values:
An integer X where 4 <= X <= 16 for desktop and 0 <= X <= 999
for mobile devices.
0 (default) - The device is never wiped after an incorrect PIN or
password is entered.
The most secure value is 0 if all policy values = 0; otherwise, Min
policy value is the most secure value.

Maximum
Number of Failed
Attempts

For Windows 10 Mobile devices: When a user reaches thevalue set by this policy, the device is wiped.

Maximum
Number of Failed
Attempts

For Windows 10 Desktop devices: When a user reaches thevalue set by this policy, it is not wiped, but put on BitLocker
recovery mode, which makes the data inaccessible but
recoverable. If BitLocker is not enabled, then the policy cannot
be enforced.

Password History

For Windows Phone 8.1 devices: This feature is notsupported.

Getting Started with MobileIron Core 11.0.0.0| 104

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

For Windows 10 devices: This feature specifies how many
passwords can be stored in the history that cannot be used.
NOTE: This policy must be wrapped in an Atomic
command.
Supported values are listed below:l

An integer X where 0 <= X <= 50.

l0 (default)

The value includes the user's current password. A setting of 1
indicates users cannot reuse their current password whenchoosing a new password and a setting of 5 indicates users
cannot set their new password to their current password or theirprevious four passwords.
The Max policy value is the most restricted.
Grace Period for
Device Lock

For macOS only: Specify the maximum amount of time thedevice can be on the screen saver without prompting for apasscode on wake from the screen saver.

None

For iOS and tvOS: only Specify the interval after the device
locks during which the user can unlock the device without
entering a passcode.
Data Encryption

These features are not supported on iOS or macOS devices.

DeviceEncryption

For Android Samsung Knox:

Off

Select On to turn on encryption. Otherwise, select Off.
NOTE: If Device Encryption is turned on, then the Password
option is automatically set to Mandatory.
For Windows:
Setting encryption is supported for Windows Phone 8.1 andWindows 10 Mobile devices. Setting encryption is not supported
for Windows 10 Desktop devices, however, encryption can be
enabled by setting it manually on the device.
Once encryption has been set, looking up encryption is
supported for all Windows devices.
If Device Encryption is turned on, it cannot be turned off. You
must reset the device to factory settings to turn off device
encryption.

Getting Started with MobileIron Core 11.0.0.0| 105

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Data TypeFor Android devices only: Indicates the data type.

none selected

File Types

For Android devices only: Indicates the file type.

none specified

SD Card
Encryption

Android Samsung Knox and LG devices only: Select On to
enforce SD card encryption. Otherwise, select Off.

Off

Supported only with Android 7.0 through the most recently
released version as supported by Mobileiron.
Supported on LG devices only with Mobile@Work 9.7 forAndroid through the most recently released version as supported
by MobileIron.
Apply to Samsung managed devices
Select to apply SD card encryption to Samsung Work Managed
Devices or Managed Device with Work Profile (COPE) mode on
Android devices versions 8-10.
Device Log
Encryption

Select On to turn on device log encryption. Otherwise, select
Off.

Off

See “Device log encryption” in the Device Management Guide forAndroid Devices.
For details on all Windows 10 Deskttop option, see the MobileIron Bridge chapter in the Device Management
Guide for Windows Devices guide.
Android(For Android only)

Require strict
TLS forApps@Work(Android only)

For Android devices only:

Not selected

Select this check box so that Mobile@Work will require strict
TLS between Apps@Work and other services, for all devices
with this Security policy applied.
The device will no longer allow you to use http:// links for override
URLs in Apps@Work.

Common Criteria
Mode (Samsung
Knox and LG
only)

For Android devices only:

Not selected

This feature is not commonly used.
For customers that require this mode, select this check box toput a Samsung Knox or LG device in Common Criteria mode.
On Samsung Knox devices, this option requires a Knox license
and the Samsung General policy enabled.
This option is supported only on Android 7.0 through the mostrecently released version as supported by MobileIron.

Getting Started with MobileIron Core 11.0.0.0| 106

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Supported on LG devices only with Mobile@Work 9.7 forAndroid through the most recently released version as supported
by MobileIron.
Apply to Samsung Managed devices
This feature is not commonly used.
For customers that require this mode, select this check box toput a Samsung managed device in Common Criteria mode.
This option is supported only on Android 7.0 through the mostrecently released version as supported by MobileIron.
Block SmartLock(from Android 5.0
only)

For Android devices only:

Not selected

Select this option to prohibit the device user from using the
Smart Lock feature on the device. Selecting this option causes
the Block Smart Lock Options to display. You must select atleast one of the Block Smart Lock Options.
The impact of selecting this option depends on the Android
version and Mobile@Work version on the device:lllWith Android 6.0 and Mobile@Work 10.1.0.0 through themost recently released versions as supported by
MobileIron: Your selections of the individual Block Smart
Lock Optionsare applied.
Android 5.0 - 5.1.1 and Mobile@Work 9.1 through the mostrecently released versions as supported by MobileIron:
Selecting Block SmartLock blocks all types of Smart
Locks, regardless of your selections of the individual
Block Smart Lock Options.
Prior to Android 5.0: No impact. Smart Lock did not exist inprior Android versions.

NOTE: This security policy setting overrides the
Lockscreen Widgets setting in the lockdown
policy.
Block Smart Lock
Options (fromAndroid 6.0)

These fields appear only if you have selected Block Smart
Lock (from Android 5.0 only).You must select at least one ofthese options.
NOTE: Support for each of these options vary acrossdevice models. Selecting an option has no impact
on devices that do not support the option.

Getting Started with MobileIron Core 11.0.0.0| 107

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Block BluetoothThis field appears only if you have selected Block Smart Lock(from Android 5.0 only)

Not selected

Select to not allow unlocking a device because it is connected toa trusted device using Bluetooth.
NOTE: Some device models combine Bluetooth and NFC
into trusted devices.
Block NFC

This field appears only if you have selected Block Smart Lock(from Android 5.0 only)

Not selected

Select to not allow unlocking a device because it is connected toa trusted device using NFC (near-field communication).
NOTE: Some device models combine Bluetooth and NFC
into trusted devices.
Block Places(Location)

This field appears only if you have selected Block Smart Lock(from Android 5.0 only)

Not selected

Select to not allow unlocking a device because of its location,
also known as a "trusted place".
Block Face

This field appears only if you have selected Block Smart Lock(from Android 5.0 only)

Not selected

Select to not allow unlocking a device because it recognizes theuser's face, also known as a "trusted face".
Block On-bodyThis field appears only if you have selected Block Smart Lock(from Android 5.0 only)

Not selected

Select to not allow unlocking a device because the user iscarrying it in their hand, pocket, or bag.
Block Voice

This field appears only if you have selected Block Smart Lock(from Android 5.0 only)Select to not allow unlocking a device
because it recognizes the user's voice.

Not selected

Block Fingerprint(from Android 5.0
or Samsung
MDM 5.3)

For Android devices only:

Not selected

Select this option to prohibit the device user from using afingerprint to access the device.
This feature requires the following on the device:l

Android 5.0 through the most recently released versions
supported by MobileIron

Getting Started with MobileIron Core 11.0.0.0| 108

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

DescriptionllDefault Policy
Setting

On Samsung devices, Samsung MDM 5.3 through themost recently released versions supported by MobileIron.
Fingerprint hardware

This setting has no impact on devices that do not meet the listed
requirements; fingerprint is allowed, if available.
NOTE: This security policy setting overrides the Lockscreen
Widgets setting in the lockdown policy.
Block Iris Scan
(Samsung andAndroid 9.0)

For Android devices only:

Not selected

Select this option to prohibit the device user from using iris
scanning to unlock the device. This option requires that thedevice is:
l

l

l

l

A Samsung device with the iris scanning feature.
A Samsung device running Samsung OS 7.0 through themost recently released version as supported by
MobileIron.
A non-Samsung device running Android 9.0 through themost recently released version as supported by
MobileIron.
Running Mobile@Work 10.1 through the most recently
released version as supported by MobileIron.

This setting has no impact on other devices.
NOTE: This security policy setting overrides the
Lockscreen Widgets setting in the lockdown
policy.
Block Face
Unlock (Samsung
and Android 9.0)

For Android devices only:

Not selected

Select this option to prohibit the device user from using facerecognition to unlock the device. This option requires that thedevice is:lll

A Samsung device with the face unlock feature
A Samsung device running Samsung OS 7.0 through themost recently released version as supported by
MobileIron.
A non-Samsung device running Android 9.0 through themost recently released version as supported by

Getting Started with MobileIron Core 11.0.0.0| 109

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

MobileIron.
l

Running Mobile@Work 10.1 through the most recently
released version as supported by MobileIron.

This setting has no impact on other devices.
NOTE: This security policy setting overrides the Lockscreen
Widgets setting in the lockdown policy.
RequireGoogle SafetyNet
Attestation

For Android devices only:

Not selected

Blocknotifications onlock screen

Android enterprise managed device profile only:

Select this option to perform SafetyNet attestation on devices.
See "Enabling SafetyNet attestation on Android devices" in the
MobileIron Core Device Management Guide for Android andAndroid enterprise Devices.
Not selected

Select this option to prevent notifications from being displayedon the device lock screen. Applies to Managed Device withWork Profile (COPE) mode on Android devices versions 8-10.

Allow only
redacted
notifications onlock screen

Android enterprise work profile only:

Not selected

Windows Phone
8.1(For Windows Phone 8.1 devices only.)

FirewallThis is available on all Windows-supported devices.

On

Anti-Virus

This is available on all Windows-supported devices.

On

Auto-Update

This is available on all Windows-supported devices.

On

Windows 10(For Windows 10 devices only.)

Defender Realtime Protection

This setting is turned on by default. Once a user turns it off it can
only be turned back on by an administrator.

On

DHA Onpremises URL

Device Health Attestation (DHA) is used to increase device
monitoring for those systems (such as government agencies)that need the information. DHA also takes a passive approach to
the data, allowing administrators to decide how they want tohandle compliance.

OffThis option will redact notifications shown on the lock screen
hiding the notification contents. Block notifications on lockscreen does not affect this. Applies to Managed Device withWork Profile (COPE) mode on Android devices versions 8-10.

Getting Started with MobileIron Core 11.0.0.0| 110

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Turning on this feature begins the collection of data, which issent to Microsoft Cloud DHA or on-prem servers. To use an onpremises server, go to the Admin Portal >Policies & Configs> Policies > select a security policy > Edit > Windows 10 >DHA On-premises URL.
NOTE: Only Microsoft Server 2016 can be used as DHAs.
Once collected and reported back the MobileIron, the information
displays on individual Device Details pages on a per-device
basis.
Administrators can use this information to determine if a device
should be wiped or looked at for other security reasons.
Access Control
For the following options, select the compliance action you want to apply to devices that trigger access
control. For detailed information on the impact that compliance actions have on devices, see “Complianceactions for security policy violations” in MobileIron Core Device Management Guide for Android and Android
enterprise Devices, MobileIron Core Device Management Guide for iOS and macOS Devices, and MobileIron
Core Device Management Guide for Windows Devices.
For All
Platforms
Apply complianceaction when adevice has notconnected toCore in x days

Select the compliance action you want to apply if a device has
not connected to MobileIron Core in the specified number ofdays.
For iOS devices: All compliance actions are supported if MDM isenabled, except for those related to Android devices, When
Data Encryption is disabled, and Application Restrictions.
Core only checks whether MDM policies are out of date.
For macOS devices: You can send an alert and quarantine thedevice.
For Android devices:
Only the following compliance actions are supported:lll

Sending alert
Blocking email access if you are using a Standalone
Sentry for email access.
Blocking app tunnels.

For Windows devices:

Getting Started with MobileIron Core 11.0.0.0| 111

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Only the following compliance actions are supported:lll

Apply complianceaction when apolicy has beenout of date for x
days

Sending alert
Blocking email access if you are using a Standalone
Sentry for email access.
Supported custom compliance actions.

Select the compliance action you want to apply if a device has
not met policy requirements for the specified number of days.
For iOS devices: All compliance actions are supported.
For macOS devices: You can send an alert and quarantine thedevice.
For Android devices:
Supports only the following compliance actions:lll

Sending alert
Blocking email access if you are using a Standalone
Sentry for email access.
Blocking app tunnels.

For Windows devices:
Supports only the following compliance actions:lllApply complianceaction when adevice violates
the following App
Control rules

Sending alert
Blocking email access if you are using a Standalone
Sentry for email access.
Supported custom compliance actions.

Select the compliance action you want to apply when a device
violates the specified App Control rules. See theMobileIron Core
Apps@Work Guide.

iOS and tvOS
Apply complianceaction when iOS
version is lessthan

Select the compliance action you want to apply when MobileIron
Core detects an iOS device having a version number less than
the specified version.

Apply compliance

Select the compliance action you want to apply when MobileIron

Getting Started with MobileIron Core 11.0.0.0| 112

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Settingaction when Data
Protection isdisabled

Core detects an iOS device that has the Data Protection featuredisabled.

Apply complianceaction when acompromised iOS
device is
detected

Select the compliance action you want to apply when MobileIron
Core detects an iOS device that has been modified tocircumvent manufacturer restrictions.
In Mobile@Work, if the compliance action specifies Enforce
compliance actions locally on devices, the following
compliance actions, if selected, are enforced on the device
without connecting to Core:l

Alert the device user with a banner or notification.

l

Block AppConnect apps.

l

l

l

The device user becomes unauthorized to use
AppConnect apps.
Retire AppConnect apps.
The device user becomes unauthorized to use
AppConnect apps and the apps’ secure data is deleted.

All other compliance actions require the device to be connectedwith Core.
Apply complianceaction for thefollowing
disallowed
devices

Select the compliance action you want to apply when MobileIron
Core detects a specified iOS device, such as AppleTV or iPad 2.

Apply complianceaction whendevice MDM isdeactivated (iOS
5 or higher)

Select the compliance action you want to apply when MobileIron
Core detects that the MDM profile has been removed from thedevice.

Enable Activation
Lock (Supervised
iOS 7 and later
devices only)

Select to enable the activation lock feature. See the section“Managing the Activation Lock for iOS devices” in the MobileIron
Core Device Management Guide for iOS and macOS Devices.

Only join Wi-Fi
networks
installed byprofiles (iOS 10.3

Enabling this option filters the Wi-Fi network choices thatdevices can join to only include the Wi-Fi networks installed byprofiles. Toggling the value of this option causes Core to push
the Wi-Fi configurations to any devices with this security policy.

Getting Started with MobileIron Core 11.0.0.0| 113

Security policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Settingand later withsupervised
devices only)
macOS
Apply complianceaction when
macOS version isless than

Select a compliance action to apply when the macOS version on
the device is less than the version you select from the drop-down
list.

Apply complianceaction when Full
Disk Encryption(FileVault) is
disabled

Select a compliance action to apply when full disk encryption(FileVault) is disabled on the device.

Apply complianceaction whendevice MDM isdeactivatedSelect a compliance action to apply when the MDM (mobile
device management) profile is deactivated on the device.

Android
Apply complianceaction whenAndroid version isless than x

Select the compliance action you want to apply when MobileIron
Core detects an Android device having a version number lessthan the specified version.

Apply complianceaction when acompromised
Android device is
detected

Select the compliance action you want to apply when MobileIron
Core detects an Android device that has been “rooted,” that is,root access has been given to an app.

Apply complianceaction when Data
Encryption isdisabled

Select the compliance action you want to apply when MobileIron
Core detects an Android device that has the Data Encryption
feature disabled.
NOTE: The quarantine action Remove All Configurations
has no impact when data encryption is disabled.

Apply complianceaction when
Samsung Knox
device attestation
fails

Select the compliance action you want to apply when MobileIron
Core detects that a Samsung Knox device has failed anattestation check.

Getting Started with MobileIron Core 11.0.0.0| 114

Privacy policies

TABLE 23. SECURITY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Apply complianceaction whendeviceadministrator isdeactivatedSelect the compliance action you want to apply when MobileIron
Core detects that the device administrator privilege has been
removed from the Mobile@Work app.

Apply complianceaction when USB
debug is enabled

Select the compliance action you want to apply when MobileIron
Core detects that USB debugging was enabled.

Bypass Factory
Reset Protection

Applies to Android enterprise devices in “work managed” mode
only.

NOTE: The quarantine action Remove All Configurations
has no impact when the device administrator isdeactivated.

enabledWhen enabled, Android’s Factory Reset Protection feature is
bypassed, and factory reset devices will be unlocked.
When disabled, Android’s Factory Reset Protection is active. A
factory reset device will be locked and will require the owner’s
Google Account credentials before the device can be set up
again.
WARNING: No administrative code exists to unlock a
factory reset device if bypass is disabled.
For Windows
devices(For Windows devices only.)

Apply complianceaction when
Windows version
is less than x

Select the compliance action you want to apply when MobileIron
Core detects an Windows device having a version number lessthan the specified version.

Don’t allow
simple password

Check this box to allow the use of a PIN, but not a simple
password such as 1234 or 1111.

Apply complianceaction when Data
Encryption isdisabled

Select the compliance action you want to apply when MobileIron
Core detects a Windows Phone 8.1 device that has the Data
Encryption feature disabled.

Application
Restrictions

For Windows devices, select the check box, then select the
restriction from the drop-down list.

Privacy policies
Note The Following:

Getting Started with MobileIron Core 11.0.0.0| 115

Privacy policieslPrivacy policies are supported on Windows 10 devices.

l

Privacy policies are not supported on macOS devices.

l

Location and Apps privacy settings currently apply only to iOS and Android devices.

Privacy policies specify which files to synchronize with MobileIron Core and whether activity or content should be
synchronized for each type of data. Privacy policies also specify which information the Mobile@Work app should
include in its log.
To create a privacy policy, go to Policies & Configs > Policies. Click Add New > Privacy. Use the following
guidelines to create or edit privacy policies:
The following table summarizes fields and descriptions in the Privacy Policy window.

TABLE 24. PRIVACY POLICY FIELDS
Item

Description

Default Policy
Setting

Name

Required. Enter a descriptive name for this policy. This is the text thatwill be displayed to identify this policy throughout the Admin Portal.
This name must be unique within this policy type.

Default Privacy
PolicyTip: Though using the same name for different policy types is allowed(e.g., Executive), consider keeping the names unique to ensure clearer
log entries.
StatusSelect Active to turn on this policy. Select Inactive to turn off thispolicy.

Priority

Specifies the priority of this custom policy relative to the other custom
policies of the same type. This priority determines which policy isapplied if more than one policy is associated with a specific device.
Select Higher than or Lower than, then select an existing policy fromthe drop-down list. For example, to give Policy A a higher priority than
Policy B, you would select “Higher than” and “Policy B”.

ActiveBecause this priority applies only to custom policies, this field is notenabled when you create the first custom policy of a given type.
Description

Enter an explanation of the purpose of this policy.

Default Privacy
PolicyApps

All Apps: Instructs the device to return to the status of all the installedapps on devices with this policy.

App Catalog
Apps

App Catalog apps: Instructs the device to return the installed statusof only the apps in Apps@Work on devices with this policy. App
Control rules are not applied.
SMS Log

For Android devices only:

None

Specify synchronization for SMS:

Getting Started with MobileIron Core 11.0.0.0| 116

Privacy policies

TABLE 24. PRIVACY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Sync Content - Clear Text: Select to archive mobile data in Core.
Sync Content - Encrypted: Select to archive the mobile data inencrypted format.
None: Select to collect no SMS data.
Call LogFor Android devices only:

None

Specify synchronization for Call:
Sync - Clear Text: Archive mobile data.
Sync - Encrypted: Archive the same data in encrypted format.
None: Do not collect Call statistics or store Call data.
iOS LocationBased Wakeups

For iOS devices only:

Disabled

iOS 6 and earlier devices use Significant Location Change forbackground wakeups. These wakeups impact jailbreak detection andupdates to certain policies.
The significant location change service provides a low-power way to
get the current location of an iOS device and be notified whensignificant changes occur. This feature governs whether the OS canperiodically bring Mobile@Work into memory.
The following options are available:
Enabled on iOS 6 and earlier: Recommended if you want to support
devices running iOS 6 and earler.
Enabled: Select this only if you want to continue using SLC.
Disabled: Select this only if you want to discontinue use of SLC,
regardless of the device version. Selecting this option greatly reduces
the likelihood that jailbreaks will be detected on devices that do notsupport silent APNS or are running the MobileIron Mobile@Work 6.0
and earlier.
NOTE: On iOS 8, 8.1, and 8.1.1, disabling Location Services in the
OS or in Mobile@Work may result in device users
receiving a notification indicating that the current
configuration requires enabling access to Location
Services.
In MobileIron Core, a setting in the Default Privacy Policy allows
toggling location based wakeups on or off. If this setting is enabled, anda user disables Location Services or disallows Location Services for
Mobile@Work, they will receive the notification. This notification does
not mean that the device is out of compliance, rather, it indicates that

Getting Started with MobileIron Core 11.0.0.0| 117

Privacy policies

TABLE 24. PRIVACY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

MobileIron Core has enabled location-based wake ups, which thedevice will be unable to perform.
Location

Specify which location data, if any, is stored on MobileIron Core.

None

NOTE: The Sync Cell Tower option is only available to Android
devices.
None: No location data is stored.
Sync Cell Tower: Cell tower data is stored.
Sync GPS if available: GPS data is stored.
Collect
Roaming Status

When enabled, roaming information is collected from the device androaming status displays in Device & Users > Devices on the Device
Details panel.

Disabled

When disabled, Mobile@Work for Android does not report any roaming
status to Core. Available in Mobile@Work for Android version 7.0 or
later.
EnableConfiguration
ProfilesClear this setting if you do not want MobileIron Core to send nonAppConnect-related configurations and certificates to MAM-only iOS
devices, including the Apps@Work web clip and certificate.

EnabledFor more information, see “Configurations and certificates for MAMonly devices” in the MobileIron Core Apps@Work Guide.
Prompt User toAdministrators have the ability to prompt device users to enable theEnable Location

device's location setting and to do it silently based on the nature of theServices if Wi-

device user. This setting is useful if the device user resides in a EU

Fi/MTD

country that has GDPR requirements. If this check box is selected, theconfiguration isdevice user is prompted to enable the location setting during thepushed (Android

registration process. If the device user does not grant permission, theenterprise)

configuration will fail. To resolve this, the device user will need to

Disabled

manually enable the device's location setting, thus triggering a device
check-in to get the Wi-Fi / MTD configurations installed onto thedevice. Applicable only for Work managed device (DO) mode andManaged device with Work profile mode on Android 10+ devices.
App Filters

For iOS apps only

iOS Installed
App Inventory

All Apps: Instructs devices to report to Core the apps installed todevices.

Managed Apps
Only (iOS 7 andlater)

Getting Started with MobileIron Core 11.0.0.0| 118

Privacy policies

TABLE 24. PRIVACY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

NOTE: Select All Apps: if you are converting unmanaged apps
to managed apps. See MobileIron Core Apps@Work
Guide.
Managed Apps Only (iOS 7 and later): Instructs devices to report toCore the managed apps installed to devices. For devices running iOS 7
through the most recently released version of iOS as supported by
MobileIron.
Specified Apps Only (iOS 7 and later): Instructs devices to report toCore the status of installed apps and managed apps whose bundle
identifiers you specify here. For devices running iOS 7 through the mostrecently released version of iOS as supported by MobileIron.
See the Apps@Work Guide for information about managed apps.
Windows 10
Inventory

This feature is supported by Windows 10 devices only.

App Store
Inventory

Displays all the App Store apps installed on the device. The options are
Enable and Disable

DisableNon Store
Inventory

Displays all the Non Store apps installed on the device. The options are
Enable and Disable

DisableSystemInventory

Displays all the System Inventory apps installed on the device. The
options are Enable and Disable

DisableGetting Started with MobileIron Core 11.0.0.0| 119

Lockdown policies

TABLE 24. PRIVACY POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Win 32Inventory

Displays all the Win 32 Inventory apps installed on the device. The
options are Enable and Disable

DisableNOTE: For Windows 10 devices with more than 100 apps, theApp inventory is updated in the database.
Android Warning Banner on the Device Reboot
Enable Warning
BannerFor Android devices only:

Unchecked

Administrators can add a warning banner that displays upon device
reboot. This is helpful for companies that require all approved mobile
operating systems, such as Android 9.0, to be managed according to asecurity baseline / guidance. Device users will see the warning banner
upon device reboot and will have to acknowledge it before continuing
use of the device.
This feature is applicable only to:lSamsung devices with Samsung Knox API 2.2l

Samsung devices in Work Managed Device modelSamsung devices in Work Profile on Company Owned Device
mode

Procedure
1. Select the Enable Warning Banner check box. A text box
displays.
2. Enter the text that you want to appear on the device.
3. Click Save. The default policy will be applied to all smart
phones and labels to which no other policy has been applied.

Lockdown policies
NOTE: Lockdown policies do not apply to iOS or macOS devices.
Lockdown policies specify which features should be disabled in the event that device access must be restricted.
To create a lockdown policy, go to Policies & Configs > Policies > Add New > Lockdown. Some policychanges can prompt users to restart their device after the policy is applied to the device.

Getting Started with MobileIron Core 11.0.0.0| 120

General lockdown policy fields

Extended lockdown policies for Android and Android enterprise devices are supported on Samsung Knox devices.
Support for specific settings sometimes depends on the Android OS version, the Mobile@Work version, and theSamsung Knox API version on the device. Extended lockdown policies are also available for Android enterprisedevices that are Work Managed Devices. Refer to the MobileIron Core Device Management Guide for Android
enterprise for details.
This section includes the following topics:l

General lockdown policy fieldslWhen work profile accounts can be modifiedlLockdown policy fields for Windows devices

Related topicsl

Lockdown policy fields for all Android devices and Android enterprise deviceslLockdown policy fields for all Android enterprise deviceslLockdown policy fields for Android enterprise devices in Work Profile mode

l

l

l

l

l

Lockdown policy fields for Android enterprise devices in Work Managed Device mode and Managed
Device with Work Profile mode
Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device mode
Lockdown policy fields for Samsung Knox Workspace (3.0) Android enterprise Managed Device with Work
Profile mode
Lockdown policy fields for Android enterprise devices with Samsung Restrictions in Work Managed
Device mode and Managed Device with Work Profile mode
Lockdown policy fields for Samsung Knox devices in Device Admin mode

General lockdown policy fields
This section describes fields that are available for Android, Android enterprise, and Windows devices.

Getting Started with MobileIron Core 11.0.0.0| 121

General lockdown policy fields

TABLE 25. LOCKDOWN POLICY FIELDS: GENERAL
Item

Description

Default Policy
Setting

Name

Required. Enter a descriptive name for this policy. This is the text thatwill be displayed to identify this policy throughout the Admin Portal.
This name must be unique within this policy type.

Default
Lockdown
PolicyTip: Though using the same name for different policy types is allowed(e.g., Executive), consider keeping the names unique to ensure clearer
log entries.
StatusSelect Active to turn on this policy. Select Inactive to turn off thispolicy.

Priority

Specifies the priority of this custom policy relative to the other custom
policies of the same type. This priority determines which policy isapplied if more than one policy is associated with a specific device.
Select “Higher than” or “Lower than”, then select an existing policy fromthe drop-down list. For example, to give Policy A a higher priority than
Policy B, you would select “Higher than” and “Policy B”. See“Prioritizing policies” in the Device Management Guide for more
information.

ActiveBecause this priority applies only to custom policies, this field is notenabled when you create the first custom policy of a given type.
Description

Enter an explanation of the purpose of this policy.

Default
Lockdown
PolicyBluetoothEnable or disable access to Bluetooth features. You can enable both
Audio and Data or just Audio.

Enable Audio &Data

Caution: MobileIron recommends against disabling audio because
hands-free Bluetooth access is disabled. Legal requirements for handsfree use of devices while driving is widespread.
NOTE: The Bluetooth settings are supported on Samsung Knox
devices. However, enabling audio only is supported onlywith Mobile@Work 9.0.1.0-9.0.1.1. See “Bluetooth
lockdown for Samsung Knox devices” in the Device
Management Guide for Android Devices for more
information.
CameraEnable or disable camera access.

EnableCamera User
Control

When checked the Camera policy is considered enforced no matter thestate of the camera. GPS location is not considered when user control
is checked.

Unchecked

Getting Started with MobileIron Core 11.0.0.0| 122

When work profile accounts can be modified

TABLE 25. LOCKDOWN POLICY FIELDS: GENERAL (CONT.)
Item

Description

Default Policy
Setting

NFC

Enable or disable NFC (Near-field Communication) data exchange
when the device touches another device.

EnableUSB Mass
Storage

Enable or disable access to the device’s USB storage from a computer.

EnableSD Card

Enable or disable access to the secure data card.

EnableWi-Fi

Enable or disable access to wireless LANs.

EnableCaution: Disabling Wi-Fi on Wi-Fi-only devices is not recommended. A
factory reset will be necessary to re-enable Wi-Fi on such devices.
NOTE: Wi-Fi lockdown is supported on Samsung Knox devices.
Roaming Data

Enable or disable access to data services while roaming.

EnableCopy / Paste

NOTE: This feature is not supported on Windows Phone 8.1
devices.

EnableEnable or disable access to copy / paste functionality.
Screen Capture

Note The Following: This feature is supported on the following
devices:lWindows Phone 8.1 and 10lAndroid version 4.0 (or higher)lAndroid version 5.0 (or higher) with Android enterprise

EnableEnable or disable screen capture.
GPS

If GPS User Control is disabled, specify whether GPS is enabled or
disabled on the device.

EnableGPS User
Control

Enable or disable the device user’s ability to turn GPS on and off.

EnableWhen work profile accounts can be modified
One Android enterprise setting in the lockdown policy is Allow the user to create and modify accounts. Thissetting applies only to work profile accounts. It does not impact personal accounts.
If this lockdown policy setting is selected, the device user or an Android enterprise app can add, modify, or delete
work profile accounts on the device in Settings > Accounts.
A four-hour time period begins after Mobile@Work receives a lockdown policy in which the setting Allow the user
to create and modify accounts is not selected. During that time period, the device user and Android enterprise

Getting Started with MobileIron Core 11.0.0.0| 123

Lockdown policy fields for Windows devices

apps on the device can continue to add, modify, and delete work profile accounts. After the time period ends, work
profile accounts cannot be added, modified, or deleted. Therefore, during this time period, the Divide Productivity or
Gmail app can add the account that you specify in the Configuration Choices section for the app in the App
Catalog on the Admin Portal. Make sure that your device users launch the Divide Productivity or Gmail app within
the four-hour time period.
Note The Following:l

Restarting a device does not restart the time period.

lChanging settings in the Configuration Choices section for Divide Productivity and Gmail in
the App Catalog on the Admin Portal will have no impact to the account settings on the device
after the time period is over. An exception to this rule exists for two app configurations. You
can change these app configurations at any time, and the account settings on the device will
be updated. These two app configurations are:odefault email signatureodefault sync window

Lockdown policy fields for Windows devices
These lockdown options are applied to Windows devices.

TABLE 26. LOCKDOWN POLICY FIELDS: WINDOWS
Item

Description

Default Policy
Setting

Internet Sharing

Enable or disable Internet sharing.

EnableMicrosoft Store

Enable or disable access to the Windows Store.

EnableNOTE: You cannot deactivate this feature for Windows 10
Desktop devices.
Manual EmailSet-upEnable or disable ability to manually add an email account on thedevice.

EnableVPN while
Roaming

Enable or disable VPN when device is out of network.

EnableHotspot
Discovery

Enable or disable Hotspot Discovery.

EnableMicrosoft
Account

Enable or disable Microsoft SkyDrive or Live Account.

EnableSave as of MSOffice

Enable or disable the Save As operation for a MS-Office document.

EnableNOTE: This feature is not supported on Windows Phone 8.1 orWindows 10 Desktop devices.

Getting Started with MobileIron Core 11.0.0.0| 124

Lockdown policy fields for Windows devices

TABLE 26. LOCKDOWN POLICY FIELDS: WINDOWS (CONT.)
Item

Description

Default Policy
Setting

Browser

Enable or disable Internet Explorer.

EnableThe option does not have any impact on any other browsers installedfrom the Windows Store.
NOTE: This feature is not supported on Windows Phone 8.1
devices.
Manual Wi-Fi
Setup

Enable or disable ability to manually add a Wi-Fi setup.

Enable

Wi-Fi Sense
Hotspots

Enable or disable the device to automatically connect to Wi-Fi Hotspots
and friend social network.

EnableSharing Of MSOffice Files

Enable or disable sharing MS-Office files.

EnableSync User
Settings to
Device(s)Enable or disable the device to automatically sync user settings to the
Windows device.

EnableAction Center
Notifications

Enable or disable Action Center notifications.

EnableDeveloper
UnlockEnable or disable Developer Unlock.

EnableSearch to Use
Location

Enable or disable the Access to my location feature on the device.
Disabling this feature impacts the Cortana and Bing.

EnableManual Root
Certificate
Installation

Enable or disable ability to manually install a root certificate on thedevice. If disabled, the device user cannot install a root certificate to thedevice.

EnableNote: This feature is not supported on Windows 10 Desktop devices.

NOTE: This feature is not supported on Windows Phone 8.1
devices.

NOTE: This feature is not supported on Windows Phone 8.1
devices.

NOTE: This feature is not supported on Windows Phone 8.1
devices.
Store Images
From Visual
SearchEnable or disable the Visual Search option in Bing.

Enable

Voice
RecordingEnable or disable voice recording in Cortana.

EnableNOTE: This feature is not supported on Windows Phone 8.1
devices.

Getting Started with MobileIron Core 11.0.0.0| 125

Lockdown policy fields for all Android devices and Android enterprise devices

TABLE 26. LOCKDOWN POLICY FIELDS: WINDOWS (CONT.)
Item

Description

Default Policy
Setting

Return Without
Password

Enable or disable ability for the device user to set grace period forlocking. If enabled, the device user can set the grace period for locking
the device. If disabled, the Security policy sets the grace period, and theoption is not available to the device user.

EnableNOTE: This feature is not supported on Windows Phone 8.1
devices.
Cortana

Enable or disable Cortana.

EnableBlock Browser
PopupsEnable or disable to block popups in browsers.

EnableBrowser
Password
Manager

Enable or disable the use of a browser password manager.

EnableMS Error
Reporting

Provides full, enhanced, basic, or security level error reporting.

Full

Let Apps Run In
Background

Allows administrators to turn off all applications running in the
background to preserve battery usage on Windows devices that are on
limited power or using cellular services.

User In Control

Windows Phone - Corporate Owned Devices Only
For Windows devices only.
Reset Phone

Enable or disable the device user's ability to reset the device to factory
defaults.

Enable

MDM
Un-enrollment

Enable or disable the device user’s ability to remove the device frommanagement by MobileIron Core.

EnableLockdown policy fields for all Android devices and Android enterprise devices
These lockdown options apply to all Android devices and all Android enterprise devices.

Getting Started with MobileIron Core 11.0.0.0| 126

Lockdown policy fields for all Android enterprise devices

TABLE 27. LOCKDOWN POLICY FIELDS: ANDROID AND ANDROID ENTERPRISE DEVICES
Item

Description

Default Policy
Setting

Lockscreen
Widgets

Enable or disable the ability to add widgets to the lockscreen. Placing
widgets on the lockscreen means device users can perform tasks
without unlocking the device.

EnableNOTE: Though Samsung Knox devices have a feature that is very
similar, it is not the Android lockscreen widgets feature,
which is what MobileIron Core controls. This option has noeffect on Knox devices.
See also: Block Fingerprint and Block SmartLock settings in the Device
Management Guide for Android Devices.
Microphone

Enable or disable access by apps to the microphone. This feature does
not impact voice calls.

EnableAlwaysConnect Device
to Managed
Wi-Fi

When enabled, device will automatically connect to a managed Wi-Fi if
one is available. This prevents users from connecting to a nearby
access point if a managed Wi-Fi is available.

DisableDebugging(USB, work
profile andmanageddevice)Enable or disable the device user’s ability to enable debugging on theUSB, work profile, and managed profile.

If a managed Wi-Fi is listed under Turn Off Wi-Fi for these SSIDs,
enabling Always Connect Device to Managed Wi-Fi will overrule thatsetting and will connect to the managed Wi-Fi.
EnableLockdown policy fields for all Android enterprise devices
Whether a lockdown policy field applies to an Android enterprise device depends on the Android enterprise modethat the device is registered in. The modes - Work Managed Device mode, Managed Device with Work Profile(COPE) mode on Android devices versions 8-10, and Work Profile on Company Owned Devices Android versions
11 through the latest version as supported by MobileIron - are described in "Modes for Android enterprise devices"in the MobileIron Core Device Management Guide for Android and Android enterprise Devices.
Lockdown options in this section apply to all Android enterprise devices in all modes. On personally owned
devices, these options do not impact the personal side of the device.

Getting Started with MobileIron Core 11.0.0.0| 127

Lockdown policy fields for all Android enterprise devices

TABLE 28. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE (ALL MODES)
Item

Description

Default Policy
Setting

Allow screen capture

Allows screen capture of apps or data inside the Android
enterprise profile

Selected

Allow the user to turnon location sharing

Allows device GPS location to be shared with Work apps.

Selected

Supported on Android 5.1 through the most recently released
version as supported by MobileIron.
For important information about Android 10-specific Wi-Fi
settings, See "Wi-Fi network priority for Android devices" intheMobileIron Core Device Management Guide for Android andAndroid enterprise Devices.

Allow modification of
applications in
Settings or launchers

Allows user to change application settings such as clearing
cache, deleting data, uninstalling, or force stopping apps in App
settings screen.

Selected

Note: use “Block uninstall” option in App Catalog app details toprevent user from uninstalling the app.
Allow the user toconfigure user
credentials

Allows user to change credentials in the Work profile, in Android
Settings > Security > Trusted Credentials > Work.

Selected

Allow the user tocreate and modify
accounts

Allows user to create or modify accounts in the Work profile, inAndroid Settings > Account.

Selected

Allow the user totransfer app data over
NFC

Allows use of NFC to transfer app data.

Google Play AutoUpdate Policy

Determines the automatic update policy that Google Play Store
uses to update apps on the device. On the device, you can view
these options by opening the Google Play Store app andselecting Settings. The option in Google Play Store settings isnamed Auto-update apps.

For more information, see When work profile accounts can be
modified.
Selected

Supported on Android 5.1 through the most recently released
version as supported by MobileIron.
User Defined

The choices for this lockdown policy field are:lll

User Defined - The device user can set the Auto-update
apps setting in Google Play Store.
Never - Google Play Store never automatically updates
apps on the device.
Wi-Fi Only - Google Play Store automatically updates

Getting Started with MobileIron Core 11.0.0.0| 128

Lockdown policy fields for all Android enterprise devices

TABLE 28. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE (ALL MODES) (CONT.)
Item

Description

Default Policy
Settingapps on the device but only using Wi-Fi, not cellular,
connections.
l

Always - Google Play Store automatically updates apps on
the device using either Wi-Fi or cellular connections.

The device user can change the Auto-update apps setting in
Google Play Store only if you select User Defined on the
lockdown policy.
NOTE: The Google Play Auto-Update Policy value only
takes effect when there are Android for enterpriseapps assigned to a device.
Enable system apps

Allows user access to the system apps that are enabled by theadministrator. This could include the system phone and camera.
This is useful when a device initially disables system apps andthen the administrator wants to enable it. Enabling does not work
if the package of the system app is not present in theconfiguration.

Not selected

Note The Following:
Because of Android limitations, in order to remove
an app from the System Apps blacklist, it is notenough for the administrator to remove theapplication's package name from "Disabled
system apps" list box in the Lockdown Policy. Due toAndroid limitations, the app's package nameshould also be listed in the "Enabled system apps" list
box.
When removing an application from the systemapps blacklist, the administrator needs to also add
it to the whitelist. This ensures the blacklisted app
becomes accessible.
Administrators need to be aware that there areconsequences when changing system apps.
Disable system apps

Prevents the user from using the system apps restricted by theadministrator.

Not selected

Note The Following:
Because of Android limitations, in order to remove
an app from the System Apps blacklist, it is notenough for the administrator to remove theGetting Started with MobileIron Core 11.0.0.0| 129

Lockdown policy fields for Android enterprise devices in Work Profile mode

TABLE 28. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE (ALL MODES) (CONT.)
Item

Description

Default Policy
Setting

application's package name from "Disabled
system apps" list box in the Lockdown Policy. Due toAndroid limitations, the app's package nameshould also be listed in the "Enabled system apps" list
box.
When removing an application from the systemapps blacklist, the administrator needs to also add
it to the whitelist. This ensures the blacklisted app
becomes accessible.
Administrators need to be aware that there areconsequences when changing system apps.
Ensure Verify apps

Restricts the user from disabling the "Verify Apps" option in
Android.

Selected

Restrict Input
Methods

Leave blank to permit ONLY system input methods, and add
specific package names to enable third-party input apps.

Not selected

This does NOT apply to devices if users have already selected athird-party input app. This configuration only restricts newchanges to the input method.
Restrict accessibility
services

Leave blank to permit ONLY system input methods, and add
specific package names to enable third-party input apps.

Not selected

This does NOT apply to devices if users have already selected athird-party accessibility service. This configuration only restricts
new changes to the accessibility service.

Lockdown policy fields for Android enterprise devices in Work Profile mode
Whether a lockdown policy field applies to an Android enterprise device depends on the Android enterprise modethat the device is registered in. The modes - Work Managed Device mode, Managed Device with Work Profile(COPE) mode on Android devices versions 8-10, and Work Profile on Company Owned Devices Android versions
11 through the latest version as supported by MobileIron - are described in "Modes for Android enterprise devices"in the MobileIron Core Device Management Guide for Android and Android enterprise Devices.
Lockdown options in this section apply to Android enterprise devices in Work Profile mode.

Getting Started with MobileIron Core 11.0.0.0| 130

Lockdown policy fields for Android enterprise devices in Work Profile mode

TABLE 29. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILE MODE
Item

Description

Default Policy
Setting

Allow copy andpaste

Allows copy and paste from apps inside the Android enterprise profile toapps outside the profile.

Selected

Allow caller ID
across profiles

Allows caller ID to be visible to phone app in all profiles.

Selected

NOTE: When the caller ID is permitted across profiles, work
contacts can be viewed by the personal apps forincoming calls. This applies to Android 6.0 through themost recently released versions as supported by
MobileIron.
Allow work

Select to allow calendar sharing of work calendar information with thecalendarpersonal profile. This is so apps can display work events alongsidesharing withpersonal events in device user's personal profile (for example calendar

personal profile

apps like Google calendar.) If the work event is tapped within the

Not selected

personal profile, a view of the event displays. Tapped again, it opens theevent in the work calendar. Applicable to Managed devices with work
profiles.
Allow contact
search acrossprofilesAllows personal space Contacts app sharing across the profile.

Selected

Allow contact
sharing on
Bluetoothdevices.

Allows the caller ID to be visible on another Bluetooth device such as
your car’s Bluetooth screen.

Allow unknown
sources inpersonal profile

Allow installation of apps from untrusted sources in the personal profile.
The work profile never allows installation of apps from unknown
sources.

Not selected

Android 8:

Allows password autofill.

Selected

Android 8:
Allow work app
notifications inpersonal profile

When device user is in personal profile, notifications from Mobile@Work

Selected

Android 8:
Allow Bluetooth

Allows Bluetooth sharing with other devices.

NOTE: This is supported on Android 7.0 devices through the mostrecently released version as supported by MobileIron.
Selected

NOTE: This is supported on Android 6.0 devices through the mostrecently released version as supported by MobileIron.

Allow Auto-Fillapps will display.

Selected

Getting Started with MobileIron Core 11.0.0.0| 131

Lockdown policy fields for Android enterprise devices in Work Managed Device mode and Managed Device with Work
Profile mode

TABLE 29. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILE MODE (CONT.)
Item

Description

Default Policy
SettingAndroid 9:
Allow Printing

Allows the printing of documents from Mobile@Work apps.

Selected

Android 9:
Allow Share into
ProfileAllows sharing from outside the Work Profile to inside the Work Profile

Selected

Sharing

Lockdown policy fields for Android enterprise devices in Work Managed Device mode andManaged Device with Work Profile mode
Whether a lockdown policy field applies to an Android enterprise device depends on the Android enterprise modethat the device is registered in. The modes — Work Managed Device mode, Managed Device with Work Profile(COPE) mode on Android devices versions 8-10, and Work Profile on Company Owned Devices Android versions
11 through the latest version as supported by MobileIron — are described in "Modes for Android enterprise devices"in MobileIron Core Device Management Guide for Android and Android enterprise Devices.
Lockdown options in this section apply to Android enterprise devices in Work Managed Device mode and Managed
Device with Work Profile (COPE) mode on Android devices versions 8-10.

TABLE 30. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORKMANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE
Item

Description

Default Policy
Setting

Allow camera

Allows camera to function.

EnabledAllow master volume
un-muteAllows the user to un-mute mastervolume. Note: volume is not muted bydefault.

EnabledAllow microphone unmute

Allows the user to un-mute microphone

EnabledAllow automatic date
& timeIf checked, the user can change date
and time.
If unchecked, user can make changes
but system will reset the date and time
automatically.

EnabledAllow automatic

Allows timezone to be set

EnabledDevice Restrictions

Getting Started with MobileIron Core 11.0.0.0| 132

Lockdown policy fields for Android enterprise devices in Work Managed Device mode and Managed Device with Work
Profile mode

TABLE 30. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORKMANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE
(CONT.)
Item

Description

Default Policy
Settingtimezone

automatically. Note: the user can reenable the ability to update time andtimezone if this setting is disallowed.

Allow safe boot of thedeviceAllows user to reboot the device into
safe mode.

EnabledAllow factory reset

Allows the user to initiate a factory resetof the device.

EnabledAllow the user tomount physicalexternal media

Allows the user to mount external media
such as SD cards or external drives.

EnabledAllow the user totransfer files over USB

Allows user copy, paste, and transfer
data and files using USB drives.

EnabledAllow use of USB
storageAllows data to be stored on USB drives.

EnabledKeep device on while
plugged inAllows device to remain powered onwhen it is plugged in to a power source.
When this field is enabled, the device
does not go into sleep mode.

Disabled

Allow Keyguard (noeffect if password or
PIN is set)

Allows a keyguard, or lockscreen, on
the device under the condition that thedevice has not been enabled using a
PIN, password, or pattern.

EnabledAllow backup service

Allows the user to backup and restore

Enabledtheir devices using Google services on
managed devices running Android 8.0
through the most recently released
versions as supported by MobileIron.
Phone & Network Restrictions
Allow SMS

Allow the user to send and receive SMS
messages.

EnabledAllow outgoing calls

Allow user to place outgoing calls.

EnabledAllow data roaming

Allow the use of data while user is

Enabled

Getting Started with MobileIron Core 11.0.0.0| 133

Lockdown policy fields for Android enterprise devices in Work Managed Device mode and Managed Device with Work
Profile mode

TABLE 30. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORKMANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE
(CONT.)
Item

Description

Default Policy
Setting

traveling outside of data plan area. Note:the user can re-enable this feature fromsettings.
Allow Wi-Fi

If Allow Wi-FI is:ll

Enabledenabled (default), the device user
can turn Wi-Fi on or off
not enabled, the device user
cannot turn Wi-Fi on
Caution: Turning off Wi-Fi on a WiFi only device will make the device
unable to communicate with
MobileIron Core or any network. A
factory reset will be needed torestore Wi-Fi capability on thedevice.

Allow Wi-Fi to be
configured

Allows the user to configure Wi-Fi.

EnabledAllow Wi-Fi sleep
policy to be configured

Allows user to configure the Wi-Fi sleep
policy. On a device, the user can reenable this feature from Settings. For
this field, the server policy settings areapplied when the device checks into
Core. If the user modifies the Wi-Fi
sleep policy on a device and then you,as the admin, change the "Allow Wi-Fi
sleep policy to be configured" field, theuser modifications for this field are
overwritten by the lockdown policy that
resides on the server when the device
checks in.

EnabledAllow Bluetooth

If Allow Bluetooth is:

Enabledllenabled (default), the deviceuser can turn Bluetooth on or off
not enabled, the device user
cannot turn Bluetooth on

Getting Started with MobileIron Core 11.0.0.0| 134

Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device mode

TABLE 30. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORKMANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE
(CONT.)
Item

Description

Default Policy
Setting

Allow Bluetooth to be
configured

Allows the user to configure Bluetoothon managed devices.

EnabledAllow Bluetooth
Outbound Sharing

Allows the user to share files using

EnabledBluetooth on managed devices running
Android 8.0 through the most recently
released versions as supported by
MobileIron.

Allow Emergency
Broadcasts to be
configured

Allows the user to configure Emergency
Broadcasts.

EnabledAllow mobile network
to be configured

Allows the user to configure the mobile
network.

EnabledAllow tethering andmobile hotspots to be
configured

Allows the user to configure tetheringand hotspots.

EnabledAllow VPN to be
configured

Allows the user to configure VPN.

EnabledIMPORTANT: This setting must be
enabled to allow theapplication of amanaged VPN. As aworkaround, enable
Always-on VPN in
Android Enterprisesettings and selectTunnel as the App
Identifier.

Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned
Device mode
Whether a lockdown policy field applies to an Android enterprise device depends on the Android enterprise modethat the device is registered in. The modes — Work Managed Device mode, Managed device with Work Profile(COPE) mode on Android devices versions 8-10, and Work Profile on Company Owned Devices Android versions

Getting Started with MobileIron Core 11.0.0.0| 135

Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device mode

11 through the latest version as supported by MobileIron — are described in "Modes for Android enterprise devices"in MobileIron Core Device Management Guide for Android and Android enterprise Devices.
Lockdown options in this section apply to Android enterprise devices in Work Profile for Company Owned Device
applicable to Android devices version 11 through the latest version as supported by MobileIron.

TABLE 31. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILEFOR COMPANY OWNED DEVICE MODE
Item

Description

Default Policy
Setting

Allow camera

Allows camera to function.

EnabledAllow master volume
un-muteAllows the user to un-mute mastervolume. Note: volume is not muted bydefault.

EnabledAllow microphone unmute

Allows the user to un-mute microphone

EnabledAllow automatic date
& timeIf checked, the user can change date
and time.
If unchecked, user can make changes
but system will reset the date and time
automatically.

EnabledAllow automatictimezone

Allows timezone to be set
automatically. Note: the user can reenable the ability to update time andtimezone if this setting is disallowed.

EnabledAllow safe boot of thedeviceAllows user to reboot the device into
safe mode.

EnabledAllow factory reset

Allows the user to initiate a factory resetof the device.

EnabledAllow the user tomount physicalexternal media

Allows the user to mount external media
such as SD cards or external drives.

EnabledAllow the user totransfer files over USB

Allows user copy, paste, and transfer
data and files using USB drives.

EnabledAllow use of USB
storageAllows data to be stored on USB drives.

EnabledKeep device on while
plugged inAllows device to remain powered onwhen it is plugged in to a power source.
When this field is enabled, the device

Disabled

Device Restrictions

Getting Started with MobileIron Core 11.0.0.0| 136

Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device mode

TABLE 31. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILEFOR COMPANY OWNED DEVICE MODE (CONT.)
Item

Description

Default Policy
Setting

does not go into sleep mode.
Allow Keyguard (noeffect if password or
PIN is set)

Allows a keyguard, or lockscreen, on
the device under the condition that thedevice has not been enabled using a
PIN, password, or pattern.

EnabledAllow backup service

Allows the user to backup and restore

Enabledtheir devices using Google services on
managed devices running Android 8.0
through the most recently released
versions as supported by MobileIron.
Phone & Network Restrictions
Allow SMS

Allow the user to send and receive SMS
messages.

EnabledAllow outgoing calls

Allow user to place outgoing calls.

EnabledAllow data roaming

Allow the use of data while user istraveling outside of data plan area. Note:the user can re-enable this feature fromsettings.

EnabledAllow Wi-Fi

If Allow Wi-FI is:

Enabledllenabled (default), the device user
can turn Wi-Fi on or off
not enabled, the device user
cannot turn Wi-Fi on
Caution: Turning off Wi-Fi on a WiFi only device will make the device
unable to communicate with
MobileIron Core or any network. A
factory reset will be needed torestore Wi-Fi capability on thedevice.

Allow Wi-Fi to be
configured

Allows the user to configure Wi-Fi.

EnabledAllow Wi-Fi sleep
policy to be configured

Allows user to configure the Wi-Fi sleep

Enabled

Getting Started with MobileIron Core 11.0.0.0| 137

Lockdown policy fields for Android enterprise devices in Work Profile for Company Owned Device mode

TABLE 31. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILEFOR COMPANY OWNED DEVICE MODE (CONT.)
Item

Description

Default Policy
Setting

policy. On a device, the user can reenable this feature from Settings. For
this field, the server policy settings areapplied when the device checks into
Core. If the user modifies the Wi-Fi
sleep policy on a device and then you,as the admin, change the "Allow Wi-Fi
sleep policy to be configured" field, theuser modifications for this field are
overwritten by the lockdown policy that
resides on the server when the device
checks in.
Allow Bluetooth

If Allow Bluetooth is:ll

Enabledenabled (default), the deviceuser can turn Bluetooth on or off
not enabled, the device user
cannot turn Bluetooth on

Allow Bluetooth to be
configured

Allows the user to configure Bluetoothon managed devices.

EnabledAllow Bluetooth
Outbound Sharing

Allows the user to share files using

EnabledBluetooth on managed devices running
Android 8.0 through the most recently
released versions as supported by
MobileIron.

Allow Emergency
Broadcasts to be
configured

Allows the user to configure Emergency
Broadcasts.

Enabled

Getting Started with MobileIron Core 11.0.0.0| 138

Lockdown policy fields for Samsung Knox Workspace (3.0) Android enterprise Managed Device with Work Profile mode

TABLE 31. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE IN WORK PROFILEFOR COMPANY OWNED DEVICE MODE (CONT.)
Item

Description

Default Policy
Setting

Allow mobile network
to be configured

Allows the user to configure the mobile
network.

EnabledAllow tethering andmobile hotspots to be
configured

Allows the user to configure tetheringand hotspots.

EnabledAllow VPN to be
configured

Allows the user to configure VPN.

EnabledIMPORTANT: This setting must be
enabled to allow theapplication of amanaged VPN. As aworkaround, enable
Always-on VPN in
Android Enterprisesettings and selectTunnel as the App
Identifier.

Lockdown policy fields for Samsung Knox Workspace (3.0) Android enterprise Managed
Device with Work Profile mode
The lockdown options in this section apply to Android enterprise Managed Device with Work Profile (COPE) modefor Samsung Knox version 3.0. These lockdowns allow you to set a variety of restrictions, such as allowing Google
accounts to auto sync, providing content sharing, and sharing of calendar information outside a container. You
must select the Enable Samsung Workspace restrictions check box to display the following fields.
NOTE: The API s in the following table may require a Samsung Knox license. If you do not have a
Samsung Knox license, these fields may not be supported.

Getting Started with MobileIron Core 11.0.0.0| 139

Lockdown policy fields for Android enterprise devices with Samsung Restrictions in Work Managed Device mode andManaged Device with Work Profile mode

TABLE 32. LOCKDOWN POLICY FIELDS: SAMSUNG KNOX WORKSPACE (3.0) ANDROID ENTERPRISE IN
MANAGED DEVICE WITH WORK PROFILE MODE
Item

Description

Default Policy
Setting

Whitelisted Google
Accounts

Allows you to whitelist specific Google Accounts. To add an
account, click the + button and type in the name of the Google
account. To delete a Google account, select the account andthen click the - button.

None

Allow camera

Allows the camera on the phone to function.

Disabled

Allow content sharing

Allows content sharing

Disabled

Allow email accountcreation

Allows the device user to create an email account.

Disabled

Allow NFC

Enable or disable NFC (Near-field Communication) data

Disabled

exchange when the device touches another device.
Allow USB

Enable or disable the USB protocol.

Disabled

Allow New Admin
Install

Enable or disable the installation of another administration app
from all sources, unless the app install is performed by the admin
enforcing this policy. This policy can only be applied if there areno other administrators activated with the exception of
Mobile@Work clients.

Disabled

Allow Google
Accounts Auto Sync

Enable or disable the ability of Google accounts to sync
automatically. This option does not block the Google Play Store
from updating installed apps.

Disabled

Enable Certificate
Revocation Status(CRL) Check

Enable or disable the Certificate Revocation List (CRL) check forrevocation of the server-certificate chain during the SSL mutual
authentication process.

Disabled

Allow sharing ofcalendar information
outside container

Enable or disable sharing of calendar information outside of thecontainer.

Disabled

Lockdown policy fields for Android enterprise devices with Samsung Restrictions in WorkManaged Device mode and Managed Device with Work Profile mode
These lockdown options are applied to Android enterprise Samsung devices in the Work Managed Device modeand Managed Device with Work Profile (COPE) mode. You must select the Enable Samsung Restrictions checkbox in order to display the Samsung Restrictions drop-down menu.

Getting Started with MobileIron Core 11.0.0.0| 140

Lockdown policy fields for Android enterprise devices with Samsung Restrictions in Work Managed Device mode andManaged Device with Work Profile mode

TABLE 33. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE DEVICES WITH SAMSUNG RESTRICTIONS IN
WORK MANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE
Item

Description

Default Policy
SettingAndroid Browser

Enable or disable access to the Android browser.

EnableEmail AccountCreation

Enable or disable the device user’s ability to configure an email
account on the device.

EnableFactory Reset

Enable or disable the ability for users to reset the device to factory
defaults.

EnableGoogle Backup

Enable or disable backup to Google servers.

EnableGoogle Play

Enable or disable access to Google Play.

EnableIncoming SMS

Enable or disable incoming SMS messages.

Enable

The user is not informed if SMS is blocked.
Outgoing SMS

Enable or disable outgoing MMS messages.

EnableIncoming MMS

Enable or disable incoming MMS messages.

Enable

The user is not informed if MMS is blocked.
Outgoing MMS

Enable or disable outgoing MMS messages.

EnableMake Passwords
VisibleSelect Enable to allow users to change the “Make Passwords
Visible” setting on their device. Select Disable to prevent users fromchanging this setting and make password characters not visible.

EnableDeveloper options

Enable or disable this option to make USB debugging available todevelopers on Samsung Knox devices.

EnableOTA Upgrade

Enable or disable over-the-air upgrades of the device firmware.

EnableOver-the-air upgrades require the device to be in recovery mode.
Therefore, for devices to perform an over-the-air upgrade, enable both
Recovery Mode and OTA Upgrade in the lockdown policy.
WARNING: Do not disable Setting Changes in the lockdown
policy if OTA Upgrade is enabled. Disabling Setting
Changes when OTA Upgrade is enabled can resultin a non-functional device because settingchanges are required for upgrade.
Recovery Mode

Enable or disable the device from entering Recovery Mode. Caution:use Disable with care. Disabling recovery mode on a device may
make the device unrecoverable if there is an issue with the device’s
operating system.

EnableGetting Started with MobileIron Core 11.0.0.0| 141

Lockdown policy fields for Android enterprise devices with Samsung Restrictions in Work Managed Device mode andManaged Device with Work Profile mode

TABLE 33. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE DEVICES WITH SAMSUNG RESTRICTIONS IN
WORK MANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE (CONT.)
Item

Description

Default Policy
SettingRoaming Voice
Calls

Enable or disable voice calls while roaming.

EnableSafe Mode

Enable or disable the user’s ability to reboot a Samsung Knox device
into Safe Mode.

EnableNOTE: A device running in Safe mode is not protected by
MobileIron, because only system apps run in Safe mode.
Setting Changes

Enable or disable the device user access to the settings app.

EnableWARNING: Do not disable Setting Changes if OTA Upgrade isenabled. Disabling Setting Changes when OTA
Upgrade is enabled can result in a non-functional
device because setting changes are required for
upgrade.
Tethering Bluetooth

Enable or disable Bluetooth tethering.

EnableTethering - USB

Enable or disable USB tethering.

EnableTethering - Wi-Fi

Enable or disable Wi-Fi tethering.

EnableUSB Media Player

Enable or disable the USB media player.

EnableManual Date Time
ChangeEnable or disable the ability to manually change the date and time.

EnableCertificate
Revocation Status(CRL) Check

Enable or disable the Certificate Revocation List (CRL) check forrevocation of the server-certificate chain during the SSL mutual
authentication process.

Disabled

Google Crash

An administrator can use this API to enable or disable sending a crash

EnableReportreport to Google. If disabled, all possible Google crash reports are

Refer to “Bluetooth lockdown for Samsung Knox devices” in the
MobileIron Core Device Management Guidefor Android Devices.

blocked.
Google Accounts
Auto-sync

Enable or disable Google accounts auto-sync.

EnableMulti-user mode

Enable or disable the Multi-user mode.

EnableNew admin
installation

Enable or disable new admin installation.

EnableGetting Started with MobileIron Core 11.0.0.0| 142

Lockdown policy fields for Samsung Knox devices in Device Admin mode

TABLE 33. LOCKDOWN POLICY FIELDS: ANDROID ENTERPRISE DEVICES WITH SAMSUNG RESTRICTIONS IN
WORK MANAGED DEVICE MODE AND MANAGED DEVICE WITH WORK PROFILE MODE (CONT.)
Item

Description

Default Policy
Setting

Allow cellular data

Enable or disable the ability for users to use cellular data.

EnableNOTE: If you disable both cellular data and Wi-Fi on a device,
MobileIron Core can no longer communicate with thedevice. The device may need a factory reset to restore
functionality.
Allow
USB HID Protocol

Enable or disable the USB Human Interface Device (HID) protocol.

EnableRestricted Apps

List apps that you want to prevent from being installed or run on
Samsung Knox devices.

(empty)Click + to add an application identifier (app ID) for the app. The app ID
is case-sensitive. You can use the wild card character * to cover a setof apps, such as all apps from a particular vendor.
For example, com.abcdef.* restricts all application IDs beginning with
com.abcdef.
However, to ensure that pre-existing apps get restricted, provide thecomplete app ID. Do not use a wild card character.
Allowed Apps

List the apps that you that are exceptions to the apps covered by a wildcard character in the Restricted Apps section.

(empty)Click + to add an application identifier (app ID) for the app. The app ID
is case-sensitive.
Turn Off Wi-Fi for
SSIDs

Prevent Samsung Knox devices from accessing the Wi-Fi SSIDs
listed in this section.

(empty)Click + to add an SSID. The SSID is case-sensitive.
NOTE: Do not restrict Wi-Fi SSIDs that are configured for thedevice.
In Mobile@Work 9.0.0.0 for Android, connection to SSIDs listed in thissection can occur if the SSID is managed and Always Connect
Device to Managed Wi-Fi is enabled.

Lockdown policy fields for Samsung Knox devices in Device Admin mode
These lockdown options are applied to Samsung Knox devices in Device Admin mode.

Getting Started with MobileIron Core 11.0.0.0| 143

Lockdown policy fields for Samsung Knox devices in Device Admin mode

TABLE 34. LOCKDOWN POLICY FIELDS: SAMSUNG(DEVICE ADMIN MODE)
Item

Description

Default Policy
SettingAndroid
Browser

Enable or disable access to the Android browser.

EnableEmail AccountCreation

Enable or disable the device user’s ability to configure an email accounton the device.

EnableCellular Data

Enable or disable the ability for users to use cellular data.

EnableNOTE: If you disable both cellular data and Wi-Fi on a device,
MobileIron Core can no longer communicate with thedevice. The device may need a factory reset to restore
functionality.
Factory Reset

Enable or disable the ability for users to reset the device to factory
defaults.

EnableGoogle Backup

Enable or disable backup to Google servers.

EnableGoogle Play

Enable or disable access to Google Play.

EnableIncoming MMS

Enable or disable incoming MMS messages.

Enable

The user is not informed if MMS is blocked.
Incoming SMS

Enable or disable incoming SMS messages.

Enable

The user is not informed if SMS is blocked.
Make
Passwords
VisibleSelect Enable to allow users to change the “Make Passwords Visible”
setting on their device. Select Disable to prevent users from changing
this setting and make password characters not visible.

EnableDeveloper
options

Enable or disable this option to make USB debugging available todevelopers on Samsung Knox devices.

EnableManagement
RemovalEnable or disable the device user’s ability to remove the Samsung DM
Agent from Android devices.

EnableOTA Upgrade

Enable or disable over-the-air upgrades of the device firmware.

EnableOver-the-air upgrades require the device to be in recovery mode.
Therefore, for devices to perform an over-the-air upgrade, enable both
Recovery Mode and OTA Upgrade in the lockdown policy.
WARNING: Do not disable Setting Changes in the lockdown
policy if OTA Upgrade is enabled. Disabling Setting
Changes when OTA Upgrade is enabled can result ina non-functional device because setting changes

Getting Started with MobileIron Core 11.0.0.0| 144

Lockdown policy fields for Samsung Knox devices in Device Admin mode

TABLE 34. LOCKDOWN POLICY FIELDS: SAMSUNG(DEVICE ADMIN MODE) (CONT.)
Item

Description

Default Policy
Setting
are required for upgrade.

Outgoing MMS

Enable or disable outgoing MMS messages.

EnableOutgoing SMS

Enable or disable outgoing SMS messages.

EnableRecovery Mode

Enable or disable the device from entering Recovery Mode. Caution:use Disable with care. Disabling recovery mode on a device may makethe device unrecoverable if there is an issue with the device’s operating
system.

EnableRoaming Voice
Calls

Enable or disable voice calls while roaming.

EnableSafe Mode

Enable or disable the user’s ability to reboot a Samsung Knox device
into Safe Mode.

EnableNOTE: A device running in Safe mode is not protected by
MobileIron, because only system apps run in Safe mode.
SettingChanges

Enable or disable the device user access to the settings app.

EnableWARNING: Do not disable Setting Changes if OTA Upgrade isenabled. Disabling Setting Changes when OTA
Upgrade is enabled can result in a non-functional
device because setting changes are required for
upgrade.
Tethering Bluetooth

Enable or disable Bluetooth tethering.

EnableTethering - USB

Enable or disable USB tethering.

EnableTethering - WiFi

Enable or disable Wi-Fi tethering.

EnableUnknown
Sources

Enable or disable installation of apps from sources other than GooglePlay.

EnableUSB Media
PlayerEnable or disable the USB media player.

EnableYouTube App

Enable or disable access to YouTube App.

EnableManual Date
Time Change

Enable or disable the ability to manually change the date and time.

EnableRefer to “Bluetooth lockdown for Samsung Knox devices” in the
MobileIron Core Device Management Guidefor Android Devices.

Getting Started with MobileIron Core 11.0.0.0| 145

Lockdown policy fields for Samsung Knox devices in Device Admin mode

TABLE 34. LOCKDOWN POLICY FIELDS: SAMSUNG(DEVICE ADMIN MODE) (CONT.)
Item

Description

Default Policy
Setting

Certificate
Revocation
Status (CRL)
CheckEnable or disable the Certificate Revocation List (CRL) check forrevocation of the server-certificate chain during the SSL mutual
authentication process.

DisableGoogle Crash

An administrator can use this API to enable or disable sending a crash

EnableReportreport to Google. If disabled, all possible Google crash reports areblocked.

GoogleAccounts Autosync

Enable or disable Google accounts auto-sync.

EnableMulti-user mode

Enable or disable the Multi-user mode

EnableNew admin
installation

Enable or disable new admin installation

EnableAllow USB HID
ProtocolEnable or disable the USB Human Interface Device (HID) protocol.

EnableGetting Started with MobileIron Core 11.0.0.0| 146

Sync policies

TABLE 34. LOCKDOWN POLICY FIELDS: SAMSUNG(DEVICE ADMIN MODE) (CONT.)
Item

Description

Default Policy
Setting

Restricted Apps

List apps that you want to prevent from being installed or run on
Samsung Knox devices.

(empty)Click + to add an application identifier (app ID) for the app. The app ID iscase-sensitive. You can use the wild card character * to cover a set ofapps, such as all apps from a particular vendor.
For example, com.abcdef.* restricts all application IDs beginning with
com.abcdef.
However, to ensure that pre-existing apps get restricted, provide thecomplete app ID. Do not use a wild card character.
Allowed Apps

List the apps that you that are exceptions to the apps covered by a wildcard character in the Restricted Apps section.

(empty)Click + to add an application identifier (app ID) for the app. The app ID iscase-sensitive.
Turn Off Wi-Fi
for these SSIDs

Prevent Samsung Knox devices from accessing the Wi-Fi SSIDs listed
in this section.

(empty)Click + to add an SSID. The SSID is case-sensitive.
NOTE: Do not restrict Wi-Fi SSIDs that are configured for thedevice.
In Mobile@Work 9.0.0.0 for Android, connection to SSIDs listed in thissection can occur if the SSID is managed and Always Connect Device
to Managed Wi-Fi is enabled.

Sync policies
Sync policies specify how Mobile@Work (Apps@Work on Windows) behaves on the device and interacts with
MobileIron Core. These interactions include synchronizing profiles, configurations, and app inventory.
NOTE: For Windows Phone 8.1 devices, only Sync Interval is applied. The sync interval is applied when
the device registers with MobileIron Core. Any changes to the sync interval after the device hasregistered are not applied to the device. If you change the sync policy with sync-interval anduser-added value, the device syncs the first three times at a 3 min interval time period and then it
syncs with the specified user sync interval time.
The following table summarizes fields and descriptions in the Sync Policy window.

Getting Started with MobileIron Core 11.0.0.0| 147

Sync policies

TABLE 35. SYNC POLICY FIELDS
Item

Description

Default Policy
Setting

Name

Required. Enter a descriptive name for this policy. This is the text thatwill be displayed to identify this policy throughout the Admin Portal.
This name must be unique within this policy type.

Default Sync
PolicyTIP: Though using the same name for different policy types isallowed (e.g., Executive), consider keeping the names
unique to ensure clearer log entries.
StatusSelect Active to turn on this policy. Select Inactive to turn off thispolicy.

Priority

Specify a priority for this policy in relation to other custom policies ofthis type. Priority determines which policy is applied in the case of aconflict. For example, if a device has two labels assigned to it, andeach label has a different sync policy, then the priority determines
which policy is applied.

ActiveSelect “Higher than” or “Lower than” and select the relative policy fromthe drop-down list. Because priority applies only to custom policies, thissetting is not available when you create the first custom policy of thistype. Default policies are not included in prioritization.
Description

Enter an explanation of the purpose of this policy.

Server IP/Host
Name

Displays the IP address or host name of the MobileIron Core instancethat the MobileIron Client will communicate with. This setting iscompleted automatically when the first phone registration is requested.

Use TLS

Specify whether to use Transport Layer Security for interactions
between MobileIron Core and the Mobile@Work app (Apps@Work on
Windows devices) installed on devices.

MigrateMobile@Work
ClientSelect to migrate Mobile@Work for Android from using port 9997
without mutual authentication to using port 443 with mutual
authentication. The device users do not need to re-register with
MobileIron Core.

Default Sync
Policyselected

For more information, see "Migrating Mobile@Work for Android to use
mutual authentication" in the MobileIron Core Device Management
Guide for Android and Android enterprise Devices.
Sync While
RoamingSpecifies which data, if any, should be synchronized with Core while
the device is roaming.
All Activity and Content: Causes all activity and content to besynchronized while the device is roaming.

Only Activity
and SMS
Content

Getting Started with MobileIron Core 11.0.0.0| 148

Sync policies

TABLE 35. SYNC POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

Only Activity and SMS Content: Restricts synchronized data toactivity and SMS content while the device is roaming. Eliminates
synchronization of some data to reduce the cost of data transfer when
additional charges may apply. This option is selected by default.
Only Roaming Status: Restricts synchronized data to roaming status
while the device is roaming. Eliminates synchronization of most data tominimize the cost of data transfer when additional charges may apply.
Synchronizing roaming status ensures that location data iscommunicated to the server and that roaming alerts can be generated ina timely fashion. International roaming alerts are not generated.
No Sync: Prevents all data from being synchronized while the device isroaming. Roaming alerts may not be generated by Event Center in atimely fashion because the device cannot communicate its roaming
status. Thus, if international roaming alerts have been configured, theMobile@Work app (Apps@Work on Windows devices) on the device
generates a local roaming alert.
Android
Notification
Mechanism

Specifies the type of notification for device updates.

Auto

Goggle Cloud Messaging: Device depends on Goggle Cloud
Messaging (GCM) to receive notifications and updates from Core.
Notification URL: Device uses the push notification URL to receive
update notifications.
Auto: Depending on the state of the device it will choose one of thenotification mechanisms described above.
NOTE: To configure the Android notification mechanism,
mutual authentication must be enabled. See "Mutual
authentication between devices and MobileIron Core" inthe MobileIron Core Device Management Guide forAndroid and Android enterprise Devices.

MutualCertificate
Authentication
RenewalWindowEnter the number of days prior to the expiration date that you want toallow devices to renew their identity certificate used for mutual
authentication with MobileIron Core. Enter a value between 1 and 60.

60

A blank value defaults to 60 days.
Related topics"Mutual authentication between devices and MobileIron Core" in the
MobileIron Core Device Management Guide.

HeartbeatInterval

NOTE: Heartbeat Interval on iOS is only supported when the app

14

Getting Started with MobileIron Core 11.0.0.0| 149

Sync policies

TABLE 35. SYNC POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

is in use (not running in the background). As such, using
the heartbeat interval on iOS is not recommended.
Specify the maximum amount of time that the Mobile@Work app(Apps@Work on Windows devices) will wait before sending a request
to MobileIron Core to confirm that the client and server are connected.
NOTE: Mobile@Work (Apps@Work on Windows devices) does
not connect to the server according to this interval unlessthe Client is Always Connected option is selected.
MobileIron Core will close the network connection for clients that havebeen inactive for twice the interval specified for this setting, thereby
reducing demand on Core.
Why: Increasing the heartbeat interval can help preserve battery life.
Decreasing the heartbeat interval helps Mobile@Work (Apps@Work
on Windows devices) detect disconnection from the MobileIron Core
more quickly.
Sync IntervalSpecify the frequency for starting the synchronization process between
the device and MobileIron Core.

240

For iOS devices only:This setting determines how often MobileIron Core sends a check-in
notification to iOS devices, which determines the frequency of jailbreak
detection.
NOTE: Decreasing this interval requires additional resources that
may increase the drain on phone batteries.
iOS LocationBased Wakeups
Interval

For iOS devices only:

15 minutes

Specifies the minimum duration between attempts to send iOS device
details to Core. This duration is adhered to when iOS brings
Mobile@Work into memory following major location change events.
When enabled, this setting specifies the minimum time period between
server polling intervals if a significant location change wakes the app.
For example, if the location-based wakeup interval is set to 15 minutes,
but a significant location change wakes a given app at 5, 12, and 16
minute intervals, the app will only poll MobileIron Core at the 16 minuteinterval. The default interval is 15 minutes.
See “iOS location-based wakeups interval and syncing with MobileIron
Core” in the Device Management Guide for iOS Devices.

MTD wakeup

Enter an MTD iOS wake-up interval in minutes. This interval

60 minutes

Getting Started with MobileIron Core 11.0.0.0| 150

Sync policies

TABLE 35. SYNC POLICY FIELDS (CONT.)
Item

Description

Default Policy
Setting

interval

determines how often Mobile@Work wakes up and scans an iOS
device. Setting this field to a low interval value, such as fifteen minutes,
is more taxing on the device's battery than setting it at a higher intervalvalue such as 60 minutes.

Client is Always
Connected

This feature is not supported on iOS devices.

Disabled

Specify whether Mobile@Work (Apps@Work on Windows devices)
should remain connected to MobileIron Core during the sync interval.
Keeping the client connected ensures timely communication between
Mobile@Work (Apps@Work on Windows devices) on the device andCore. You might consider disabling this feature if battery drain becomes
an issue. See “Android devices and the Client Is Always Connected” inthe Device Management Guide for Android Devices.

Getting Started with MobileIron Core 11.0.0.0| 151

6Managing Labels
This section describes basic operations to perform with labels, including how to apply a device to a label, search fora label, remove a device from a label, filter labels, as well as create and edit labels. In addition, complex operations
are provided such as how to create a dynamic label, calculating devices impacted by changing or removing labels,
and creating a label based on custom LDAP user attributes.
lApply to Labell

Device label searchlUsing search for device labelslRemove from labellApplying a device to a labellRemoving a device from labellUsing search for device labelsl

Using labels to establish groupslDefault labelslFilter and manual type labelslCreating labelsl

Editing Labelsl

Copying a label to a new labellViewing devices currently associated with a labellAssociating a filter with a label: dynamic labelslDeleting labelslSearching for device labelslViewing label use

lCalculating devices impacted by changing or removing labelslCreating a label based on custom LDAP user attributes

Apply to Label
Applying a device to a label tags the phone as part of the associated group. When you specify a label for an action,
you perform the action on all devices having the label. See Using labels to establish groups for more information onlabels.

Getting Started with MobileIron Core 11.0.0.0| 152

Device label search

Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Select the check box for the device.
4. Click Apply To Label from the Actions menu.
5. Select the label to apply from the Apply To Label dialog.
Only labels that have not already been associated with this device will be displayed. For example, iOS
devices are automatically applied to the iOS label, Android devices to the Android label, and so on. Also,
automatic labels that are not applicable to this device do not appear in the list. For example, the Windows
label and Windows Phone label will not appear for a device from a different platform.
6. Click Apply.
For more information about labels for Android enterprise, see the MobileIron Core Apps@Work Guide.

Device label search
When you apply devices to labels, you can use search criteria to find the label you want to use. You no longer needto scroll through the list to find the label you want.

Using search for device labels
When you apply devices to labels, you specify search criteria to filter the label list to the label you want to use.
Procedure
1. From the Admin Portal, go to Devices & Users > Devices.
2. Check one or more devices that you want to apply to a label.
3. In Apply to Label, enter one or more characters in Search by Name or Description.

Getting Started with MobileIron Core 11.0.0.0| 153

Remove from label

For example, enter “ca” to find all labels that begin with the letters “ca”. MobileIron Core displays the labelsthat match what you entered.
4. Check the label you want to use from the search results.
5. Click Apply.

Remove from label
Removing a device from a label removes the following from the device:lthe tag that makes it a part of the associated group (see Using labels to establish groups for more
information on labels)lpolicies applied to that labellapps applied to that labelliBooks applied to that label (iOS only)

Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Select the check box for the device or devices.
4. Click Actions > Remove From Label.
5. Select the label from the Remove From Label dialog.
6. Click Remove.

Getting Started with MobileIron Core 11.0.0.0| 154

Applying a device to a label

Applying a device to a label
Applying a device to a label tags the device as part of the associated group. When you specify a label for an action,
you perform the action on all devices having the label. See Using labels to establish groups for more information onlabels.
Procedure
1. From the Admin Portal, go to Device & Users > Devices.
2. Select the check box for the device.
3. Click Apply To Label from the Actions menu.
4. Select the label to apply from the Apply To Label dialog.
Only labels that have not already been associated with this device will be displayed. For example, iOS
devices are automatically applied to the iOS label, Android devices to the Android label, and so on. Also,
automatic labels that are not applicable to this device do not appear in the list. For example, the Windows
label and Windows Phone label will not appear for a device from a different platform.
5. Click Apply.

Removing a device from label
Removing a device from a label removes the following from the device:lthe tag that makes it a part of the associated group (see Using labels to establish groups for more
information on labels)lpolicies applied to that labellapps applied to that labelliBooks applied to that label (iOS only)

Procedure
1. From the Admin Portal, go to Device & Users > Devices.
2. Select the check box for the device or devices.
3. Click Actions > Remove From Label.
4. Select the label from the Remove From Label dialog.
5. Click Remove.

Using search for device labels
When you apply devices to labels, you specify search criteria to filter the label list to the label you want to use.

Getting Started with MobileIron Core 11.0.0.0| 155

Using labels to establish groups

Procedure
1. Log into the Admin Portal.
2. Go to Devices & Users > Devices.
3. Check one or more devices that you want to apply to a label.
4. In Apply to Label, enter one or more characters in Search by Name or Description.

For example, enter “ca” to find all labels that begin with the letters “ca”. MobileIron Core displays the labelsthat match what you entered.
5. Check the label you want to use from the search results.
6. Click Apply.

Using labels to establish groups
You can use labels for devices, apps, policies, and events. This process forms a group. For example, you might
create a label called “Executives” to tag devices belonging to employees at the executive level. You can thenlocate all of these devices quickly in a search, or apply policies based on whether a device has this label.

Getting Started with MobileIron Core 11.0.0.0| 156

Default labels

FIGURE 8. USING LABELS TO ESTABLISH GROUPS

Default labels
The following system labels are always available, by default:

TABLE 36. DEFAULT LABELS
LabelDescription

All-Smartphones

Automatically applied to all devices at registration.

Android

Automatically applied to registered devices that have the Android platform
selected during registration.

Company-Owned

Automatically applied to registered devices that have the Company check box
selected during registration.

Employee-Owned

Automatically applied to registered devices that have the Employee check box
selected during registration.

iOS

Automatically applied to registered devices that have the iOS platform selectedduring registration.

macOS

Automatically applied to registered Apple devices that have macOS selectedduring registration.

Signed-Out

Automatically applied to any multi-user iOS device that does not have a signedin user.

Getting Started with MobileIron Core 11.0.0.0| 157

Filter and manual type labels

TABLE 36. DEFAULT LABELS (CONT.)Label

Description

tvOS

Automatically applied to registered devices that have the tvOS platform
selected during registration.

Windows

Automatically applied to Windows 10 devices.

Windows Phone

Automatically applied to Windows Phone devices.

NOTE: You cannot delete default labels.

Filter and manual type labels
Labels fall into the following categories:lFilterlManualFilter labels (also called dynamic labels) use specific criteria to define a group of devices. Manual labels have nocriteria associated with them; you select each device associated with a manual label.
When you initially create a label, it is stored as a filter label. If you use the Advanced Search feature to specify thecriteria for a label, then it remains a filter label. Otherwise, if you select devices in an Admin Portal screen and apply
the label to them, then the label becomes a manual label.

Creating labels
There are two ways to create a label:l

Use Advanced Search and save the criteria to a new label.

lCreate a new label.

Procedure
1. From the Admin Portal, go to Device & Users > Labels.
2. Click Add Label. The Add Label window opens.

Getting Started with MobileIron Core 11.0.0.0| 158

Add label window

Refer to the guidelines in the Add label window table to complete the fields.
3. Click Save. You can now apply this label to devices, policies, and configurations. See Applying a device toa label.

Add label window
The following system labels are always available, by default:

Getting Started with MobileIron Core 11.0.0.0| 159

Editing Labels

TABLE 37. ADD LABEL FIELDS
Field

Description

ExampleName

Enter a unique name that clearly identifies the purposeof the label. The following characters are allowed whenentering a label name. All other characters, including
spaces, are prohibited.

ExecutiveTeamlLetters (uppercase and lowercase)lNumbers (0-9)

lDashes (-)

l

Underscores (_)

l

Periods (.)

lAt sign (@)

l

Dollar sign ($)

lHash tag (#)

l

Extended ASCII/UTF-8

Description

Provide additional meaning and usage information.

Type

By default, the type is Filter.

For members of theexecutive staff reporting toJohn Smith

Change it to Manual if you want to manually associate
devices with the label.
Criteria

If the type is Filter, use the query builder to create asearch expression that defines the devices to apply thelabel to. Alternatively, manually enter a search
expression.
The matching devices are automatically displayed.

Editing Labels
In Device & Users > Labels, you can edit:lthe name and description of any existing label.

lthe type of a label (manual or filter).
NOTE: You can change a label’s type only if it is not assigned to any devices.

lthe criteria of a filter label.

If you change a label’s type from manual to filter, you can use the query builder to define the filter.

Getting Started with MobileIron Core 11.0.0.0| 160

Copying a label to a new label

However, if you are changing a filter label’s criteria, only manual editing is available to edit the criteria. The querybuilder is not available.
You can determine the string for the criteria by first navigating to Devices & Users > Devices and clicking
Advanced Search. Use the user interface to create the criteria string and then copy it for pasting into the Edit
Label dialog.
NOTE: You cannot edit the criteria of pre-defined labels such as All-SmartPhones, Android, iOS,
Company-Owned, and so on.
Procedure
1. From the Admin Portal, go to Device & Users > Labels.
2. Select a label.
3. Click Actions > Edit Label.
4. Edit the name and/or description.
The label name must be unique.
5. Click Manual or Filter to change the label type.
Important: You can change a label’s type only if it is not assigned to any devices.
6. For filter labels, edit the criteria.
If the type was already filter, manually edit the criteria.
If you changed the type to filter, either use the query builder or manually edit the filter.
7. Click Save.

Copying a label to a new label
You can copy a label to a new label. You choose which device space the new label will belong to. This action isespecially useful when creating similar labels in multiple spaces.
Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Labels.
3. Select a label.
4. Click Actions > Save as.
5. Enter a name for the new label.
6. Enter a description for the new label.
7. Choose which device space the new label will belong to. You select the device space from the set ofdevice spaces for which you have the role Manage label.
NOTE: If the global space is the only defined space, the dialog does not display the space dropdown box.

Getting Started with MobileIron Core 11.0.0.0| 161

Viewing devices currently associated with a label

Although you cannot modify the criteria when copying a filter label, you can edit the criteria of the newlabel.
8. Click Save.

Viewing devices currently associated with a label
You can view the devices currently associated with a specific label.
Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Labels.
3. Click the link in the View Devices column.
The devices are filtered by the label, and shown on the Devices page (Device & Users > Devices).
4. To return to the Labels page, click the Labels tab.

Associating a filter with a label: dynamic labels
You can use the Advanced Search feature in the Device & Users > Devices page to associate a filter (search)with a label. The resulting dynamic label represents the devices defined by the filter at a given time.

Example: Creating a label for devices by operator
You can create a label for all devices having a specific operator.
Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Cick Advanced Search.
4. In the Field drop-down, type operator and select either Current Operator Name or Home Operator Name.
5. Select a logical operator from the operator drop-down.
6. Select the Country and Operator.
7. Click Save To Label, and provide a name and description for the new label.

Example: Creating a label for devices by LDAP group
You can create a label for all devices associated with a specific LDAP group.

Getting Started with MobileIron Core 11.0.0.0| 162

Deleting labels

Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Click Advanced Search.
4. In the Field drop-down, click to expand User Fields > LDAP > Groups.
5. Select Name.
6. Select a logical operator from the operator drop-down.
7. Select an LDAP group from the drop-down.
NOTE: The drop-down shows the LDAP groups that are selected in Services > LDAP, in the LDAPGroups section of the Modifying LDAP Settings dialog.
8. Click Save To Label, and provide a name and description for the new label.

Deleting labels
To delete a label:l

Log into the Admin Portal.

l

Go to Device & Users > Labels.

lSelect the label you want to delete.

lClick Delete.

NOTE: Default labels cannot be deleted. See Default labels.

Searching for device labels
When you apply devices to labels, you can specify search criteria rather than scroll through the list when selecting
the label.
Procedure
1. From the Admin Portal, go to Devices & Users.
2. Select Devices.
3. Check one or more devices that you want to apply to a label.
4. In Apply to Label, enter one or more characters in Search by Name or Description.

Getting Started with MobileIron Core 11.0.0.0| 163

Viewing label use

For example, enter “ca” to find all labels that begin with the letters “ca”. Core displays the labels that match
what you entered.
5. Check the label you want to use from the search results.
6. Click Apply.

Viewing label use
MobileIron Core provides a consolidated view of all places each label is used in your Core instance. You can view
how many of the following objects are applied to each label:ldevices

l

users

l

policieslconfigurations

l

apps

Viewing your label use helps you understand how changing, adding, or deleting labels will affect your managed
devices.
Procedure
1. From the Admin Portal, go to Device & Users > Labels.
2. Click the up arrow next to the label that you want to investigate.
3. The expanded display lists the number of devices, users, policies, configurations, and apps applied to theGetting Started with MobileIron Core 11.0.0.0| 164

Calculating devices impacted by changing or removing labels

label.
4. To return to the label list, click the down arrow for the label you are viewing.

Calculating devices impacted by changing or removing labels
Before you change what is applied to a label, or delete a label, you would like to know if that action impacts a large
number of devices. Knowing that a large number of devices are affected by an action might cause you to rethink
your actions.
You can set a threshold for the number of devices impacted by the following actions:lremoving a configuration from a labelldeleting a label

If either of these actions impact the number of devices you set as a threshold or more, you are notified, and candecide to modify or cancel the action.
The default threshold Core uses is 100 devices, which can be changed in Settings.
If deleting a label or removing a configuration from a label affects a number of devices that exceeds the threshold,you receive an alert that:llets you know that the action would affect more than the threshold number of deviceslasks you if you want to cancel the action or continuelrequests that you enter a reason for the action if you continue

For example, if you set the threshold to 90 devices, alerts are sent if 91 or more devices are affected by the action.

Setting the device impact threshold
The default number of devices for the Device Impact Threshold is 100. You can set this to a different number, if
your MobileIron Core implementation requires.
Procedure
1. Log into the Admin Portal.
2. Go to to Settings > System Settings.
3. Go to General > Enterprise, enter the number of devices in Device Impact Threshold.
4. Click Save.
The correct threshold differs among deployments. What you are determining is the number of devices you will put
at risk with a label action without wanting a warning first and a reason that you can track if the action causes
problems.

Getting Started with MobileIron Core 11.0.0.0| 165

Responding to label action alerts

For some deployments that number can be ten devices. For other deployments it may be 500 devices. If you are
not certain what number to specify:lStart with the default number, 100 devicesl

If many label actions impact more than 100 devices, you might find the warning messages occur too oftenl

If you want to understand the impact of all label and configuration label removals for some period of time,
you can lower Device Impact Threshold to monitor the effects of these actions.

Responding to label action alerts
If either removing a configuration from a label or deleting a label affects more than the set threshold of devices, amessage displays letting you know that the action affects more than the threshold number of devices and asking
you for guidance.
Procedure
1. If you decide to cancel the action, click No.
2. To complete the action, enter the reason why you are continuing in Reason, and then click Yes.

Creating a label based on custom LDAP user attributes
If you have one or more custom user attributes defined in your LDAP settings, you can create a label using thecustom attributes.
There are two types of custom LDAP attributes available in advanced search.
llCustom 1 through Custom 4 are always available in the field list in advanced search, and appear as“custom1” through “custom4”.
Custom Attribute 1, Custom Attribute 2, and so on, are available in advanced search only if they are
assigned in LDAP settings. These custom attributes appear in the field list as the value they wereassigned in the setting. For example, if Custom Attribute 1 is set to “Manager” in LDAP settings, it appears
in the advanced search field list as “Manager”, under User Fields> LDAP >User Attributes.

To view the custom attributes in the LDAP settings, go to Services > LDAP. Click the LDAP instance to open the
LDAP details. If you make changes to LDAP settings, LDAP is synced automatically.
Procedure
1. Log into the Admin Portal.
2. Go to Device & Users > Devices.
3. Click the advanced search icon.
4. In the query builder, click Field and select the custom attribute, found under User Fields > LDAP > User
Attributes.
Complete your search criteria using the query builder or by manually editing the expression.

Getting Started with MobileIron Core 11.0.0.0| 166

Creating a label based on custom LDAP user attributes

5. Click Save To Label.
6. Type a name and description for the new label.

Getting Started with MobileIron Core 11.0.0.0| 167

7
Using the Dashboard
This chapter provides procedures for the most common uses of Core:l

Dashboard overviewlDashboard chartsl

Arranging the devices dashboard chartslChanging the charts included in the dashboardlDevices associated with chart sections in the devices dashboardlDisplaying device lists from devices dashboard chartslAdding an app chart to the apps dashboard

Dashboard overview
The Dashboard page provides a snapshot of the devices known to MobileIron Core. Also, if apps analytics is
enabled, the apps dashboard shows information about app usage.
Each chart on the devices dashboard can be displayed as a:lpie chartlbar chart

l

table

To switch among the chart choices, select the chart-type icon at the bottom of the chart. Note that the New Device
Registrations chart and the Pending Device Registrations chart are displayed only as tables.
MobileIron Core continuously updates the information in the devices dashboard.

Dashboard charts
The dashboard displays charts offering device and app insights and analytics. The devices dashboard is always
displayed. The apps dashboard is displayed only if you have enabled it.
The devices dashboard contains the following charts:

Getting Started with MobileIron Core 11.0.0.0| 168

Dashboard charts

TABLE 38. DEVICES DASHBOARD CHARTS
Chart

Description

Device By Status

Displays the percentage of phones having each registration status (forexample, Pending).

Device By ComplianceDisplays the percentage of devices that are in compliance with the assigned
policy.

Device By OS Type

Displays the percentage of devices running each supported operating system.

Device By OS Version

Displays the percentage of devices running each version of the supported
operating systems.

Device Roaming By
Country

Displays the percentage of devices that are roaming for each country.

Device By Ownership

Displays the percentage of devices that are company-owned and thepercentage of devices that are user-owned.

Device By Operator

Displays the percentage of devices each service provider reported, including
Wi-Fi.

New Device Registrations

Displays the latest phones to begin the registration process.

Pending Device
Registrations

Displays the phones that have a status of Pending.

Devices by Phishing

Displays the number of users that have / have not enabled MobileIron Phishing
Protection on their device. For more information, see the MobileIron Threat
Defense Solution Guide for Core.

Protection Enabled

The apps dashboard includes the following charts:

TABLE 39. APPS DASHBOARD CHARTS
Chart

Description

Top installed apps

Displays the top ten most installed apps. You can filter the chart by All, Public,
and In-House. You can click the data points to drill down to specific app details.

Top 5 rated in-house Apps

Displays the "Top 5 Rated In-House Apps" in Apps@Work for iOS, macOS,
and Android across all managed devices. The chart includes the rating and thenumber of raters for each app. You can click the data points to drill down tospecific app details.

In-House app distributions
requiring install

Displays the 5 in-house apps most needing action to improve their distribution.

Public app distributions
requiring install

Displays the 5 public apps most needing action to improve their distribution.

App distribution

The single app chart displays the number of devices the app (or a specificversion of the app) has been distributed to and is eligible to be distributed to.
Getting Started with MobileIron Core 11.0.0.0| 169

Viewing the App Dashboard

Viewing the App Dashboard
In order to view the Apps tab in the Dashboard:llthe app analytics feature needs to be enabled
the user with global space permissions needs to be granted View App Dashboard or View Device
Dashboard permissions

If the app analytics feature is disabled, the Apps tab will not display in the Dashboard. For how to set app analytics,
see "EXEC PRIVILEGED mode commands" in the MobileIron Core Command Line Interface (CLI) Reference.
Procedure
1. Go to Admin > Admins.
2. Select the user, click Action > Edit Roles.
The Edit Roles dialog box opens.
3. Scroll to the App Management section.
4. Select the View app dashboard check box.
5. The permissions display in the right panel of the dialog box.
6. Click Save.

Arranging the devices dashboard charts
You can drag & drop the devices dashboard charts from one position to another on your screen, to align the charts
in any order you choose. When you move a chart, you move it to the position of one of the other charts or an empty
spot on the dashboard.
Procedure
1. Log into the Admin Portal.
2. Click on the dashboard chart name.
3. Drag the chart to the new position.

Changing the charts included in the dashboard
You can remove any of the charts from the dashboard and add them back to the dashboard when you choose.
Procedure
1. Log into the Admin Portal.
2. Click the X in the upper-right corner of the chart to remove it from the dashboard.

Getting Started with MobileIron Core 11.0.0.0| 170

Devices associated with chart sections in the devices dashboard

3. Click Add, select a chart from the list, and then click Add Chart to add a closed chart to the dashboard.
The chart is added as the last chart on your display.

Devices associated with chart sections in the devices
dashboard
Each category of information in a dashboard chart can be displayed as a list of devices.
Example:ll

If you display the Device By OS Type chart as a bar graph, clicking the bar for Android displays all theregistered devices using Android. Similarly, clicking the bar for iOS or Windows displays all the registereddevices using iOS or Windows.
If you display Device By Status as a pie chart, clicking one of the chart slices displays a list of thedevices included in that chart slice.

NOTE: The device list page also displays the advanced search box with the query that produces the listof devices associated with the chart category.
Listing the devices associated with a category in a dashboard chart:lidentifies which devices belong to a categorylenables more-informed decisions about device actions

Using the Advanced Search box displayed with the device list you can:lgenerate precise category-based search criteria.

lmodify the category search criteria.

lsave the category search criteria as a label.

lrerun the query using the Search button.

Displaying device lists from devices dashboard charts
You can use the devices dashboard charts to display device lists by specified criteria.
Procedure
1. In the Admin Portal, go to Dashboard > Devices.
2. Click a category from one of the dashboard charts (for example, click a slice in a pie chart or a bar in a bar
graph).

Getting Started with MobileIron Core 11.0.0.0| 171

Adding an app chart to the apps dashboard

The devices included in that category are displayed in a separate window.
The advanced search box displays at the top of this window.
3. Click the X at the top of the window when you are done.
The advanced search box displays the filter that generates the device list. You can:l

use the filter to rerun the search.

lmodify the filter to generate a different set of devices.

lsave the filter as a label, creating a dynamic label that represents the devices defined by the filter at a given
time.

l

click the Reset button to delete any changes you made to the original query.

lclick the Clear button to delete the current query criteria.

Adding an app chart to the apps dashboard
When the apps dashboard is enabled, you can add additional charts for individual apps.
NOTE: When changing the name of an app in the App Catalog after creating an app chart with thatapp, the new app name is not reflected in the app chart. If you want the new app name to bereflected in the app chart, you must delete the app chart with that app and create a new app
chart.
Procedure
1. In the Admin Portal, select Dashboard.
2. 2. Select Apps.
3. Click Add.
4. Select the Chart Type from the drop-down list.

Getting Started with MobileIron Core 11.0.0.0| 172

Deleting an app chart

5. In the text field provided, type the name of the app for which you want to create a single app chart.
A list of apps matching the name in the text field appears under Selected App.
6. Select the app in under Selected App.
7. Click Add Chart.
A new chart with the title App Distribution appears in the apps dashboard for the selected app

Deleting an app chart
You can delete an app chart by clicking the X in the upper right-hand corner of the app's App Distribution chart.

Getting Started with MobileIron Core 11.0.0.0| 173