MobileIron AppStation 72 for Android
Guide for Administrators
September 8, 2020
For complete product documentation see:MobileIron AppStation Product Documentation Home Page

Proprietary and Confidential | Do Not DistributeCopyright © 2019 - 2020 MobileIron, Inc. All Rights Reserved.
Any reproduction or redistribution of part or all of these materials is strictly prohibited. Information in this publication
is subject to change without notice. MobileIron, Inc. does not warrant the use of this publication. For some phone
images, a third-party database and image library, Copyright © 2007-2009 Aeleeta's Art and Design Studio, is used.
This database and image library cannot be distributed separate from the MobileIron product.
“MobileIron,” the MobileIron logos and other trade names, trademarks or service marks of MobileIron, Inc.
appearing in this documentation are the property of MobileIron, Inc. This documentation contains additional trade
names, trademarks and service marks of others, which are the property of their respective owners. We do notintend our use or display of other companies’ trade names, trademarks or service marks to imply a relationshipwith, or endorsement or sponsorship of us by, these other companies.

MobileIron AppStation 72 for Android Guide for Administrators| 2

Contents

ContentsContents

3New features and enhancements

4About MobileIron AppStation

5

MobileIron AppStation overview

5

MAM-only use cases with MobileIron AppStation

5

MobileIron Go and MobileIron AppStation interaction

6

Android AppConnect app behavior with MobileIron AppStation

6

Android AppStation and Android enterprise7

MAM-only deployment diagrams

7

MAM-only with AppStation

7

MAM-only with AppStation and MDM with other platform

8

MobileIron AppStation configuration9

Supported configurations for managing apps through AppStation

9

Administrator actions supported for AppStation

9Setting up MobileIron AppStation

10AppStation configuration steps overview

10

Configuring MAM-only in MobileIron Cloud11

Add apps for distribution

11

Verify the setup for AppStation

12

What users see in MobileIron AppStation for Android

13

Download and install AppStation for Android

13

Register with MobileIron Cloud

13

Launcher and Catalog

14

Mobile Threat Defense

15

Settings

16

MobileIron AppStation 72 for Android Guide for Administrators| 3

1
New features and enhancements
This guide documents the following new features and enhancements:
lRebranding: MobileIron has updated the AppStation for Android icon and user interface color scheme.
For more information, see What users see in MobileIron AppStation for Android.

lAdditional threat defense information: If you have a MobileIron Threat Defense (MTD) deployment,
users see additional threat defense information when they tap on the MTD icon in AppStation. Users see
the device and network-specific threat details and descriptions on how to fix the threats.
For information on the MTD user experience on AppStation, see Mobile Threat Defense.

lSupport for MobileIron Go and MobileIron AppStation on the same device: The support allows for
the MAM-only use case where you have contractors whose devices are already managed by anotherinstance of MobileIron Cloud, however, you need to deploy required apps from your instance of MobileIron
Cloud to the device.
The supported MAM-only use cases are described in MAM-only use cases with MobileIron AppStation andMobileIron Go and MobileIron AppStation interaction.

MobileIron AppStation 72 for Android Guide for Administrators| 4

2About MobileIron AppStation
The following provide an overview of MobileIron AppStation for Android:lMobileIron AppStation overviewlMAM-only use cases with MobileIron AppStationlAndroid AppConnect app behavior with MobileIron AppStationl

MAM-only deployment diagramsl

MobileIron AppStation configuration

MobileIron AppStation overview
Deploying a MobileIron unified endpoint management (UEM) platform allows you to secure and manage mobiledevices as well as mobile apps in your enterprise. The term mobile device management (MDM) is used to describe
the features, policies, and configuration used for securing and managing mobile devices. The term mobile apps
management (MAM) is used to describe the features, configuration, and policies used for securing, managing anddistributing enterprise apps to mobile devices. In most cases, you deploy MobileIron UEM to do both MDM andMAM. However, in some cases, you may want to manage only the apps on the device without having to manage
the device itself. A deployment through which only apps on a device are managed is called MAM-only.
MobileIron AppStation is specifically designed as the UEM client for a MAM-only deployment with MobileIron
Cloud. In a MobileIron AppStation MAM-only deployment, only apps available through AppStation are managed.
The following types of apps are supported:l

AppConnect apps (wrapped with Secure Apps Manager for AppStation)l

Non-AppConnect apps (in-house or from the Google Play Store)

MAM-only use cases with MobileIron AppStation
The following MAM-only use cases are supported with an AppStation deployment:ll

You have employees or seasonal workers who need your relevant apps on their personal devices, but yourprivacy or legal requirements do not allow device management.
You have contractors who need your relevant apps, but their devices are managed. The device may be
managed by MobileIron Cloud, MobileIron Core or another MDM provider.

NOTE: If you already have a MAM-only deployment using MobileIron Go, you can continue with thedeployment. However, MobileIron recommends using MobileIron AppStation for new MAM-onlyMobileIron AppStation 72 for Android Guide for Administrators| 5

MobileIron Go and MobileIron AppStation interaction

deployments. AppStation supports additional use cases that are not supported with MAM-onlyusing MobileIron Go.

MobileIron Go and MobileIron AppStation interaction
The following behavior is seen when both MobileIron Go and AppStation are deployed to a device:llll

All MobileIron Threat Defense actions are applied to the device irrespective of the tenant on which theactions are configured. For any particular setting, the stricter configuration takes precedence.
In cases where the apps required from the MAM Cloud tenant (contractor) are blacklisted by the MDM
Cloud tenant, the MDM Cloud administrator has to allow the apps for the contractor device registered tothe MAM Cloud tenant.
For anti-phishing policies, the last client, MobileIron Go or AppStation, used on the device becomes thedefault browser.
The MDM Cloud tenant administrator can take actions, such as Wipe, which affect any app installed on
the device, including AppStation.

For the configurations, apps, and actions supported for MobileIron AppStation, see MobileIron AppStation
configuration.

Android AppConnect app behavior with MobileIron AppStation
If a device has both Mobile@Work for device management (MDM), as well as MobileIron AppStation for MAMonly, AppConnect wrapped apps and AppStation wrapped apps continue to work as expected since the apps arewrapped with different flavors of Secure Apps Manager.
The AppConnect apps that work with MobileIron AppStation are wrapped with Secure Apps Manager forAppStation. The AppConnect apps that work with Mobile@Work are wrapped with the regular Secure Apps
Manager. Therefore, Apps that are wrapped with Secure Apps Manager for AppStation work with AppStation onlyand apps that are wrapped with the regular Secure Apps Manager continue to work with Mobile@Work.
When wrapping an app in the AppConnect Wrapping Portal, you have the option to wrap it with Secure Apps
Manager for AppStation. Apps that are wrapped with the AppStation option have the following package name:lappstation.<your app package name>

For information about wrapping AppConnect apps, see the MobileIron AppConnect for Android App Developers
Guide.

MobileIron AppStation 72 for Android Guide for Administrators| 6

Android AppStation and Android enterprise

Android AppStation and Android enterprise
If a MobileIron Cloud tenant supports both Work Profile for device management (MDM), as well as MobileIron
AppStation for MAM-only, the Work Profile policies and configurations take priority.
Therefore, MobileIron recommends creating separate user groups for Android enterprise and for MAM-only. Do thefollowing:l

Apply the MAM-only devices to the MAM-only user group.

lDo not apply Android enterprise devices, polices, and configurations, to the MAM-only user group. TheAndroid enterprise configurations are:oAndroid enterprise: Work Profile (Android for Work)oAndroid enterprise: Work Managed Device (Android for Work)oAndroid enterprise: Managed Device with Work Profile/Work Profile on Company Owned device

MAM-only deployment diagrams
The following provides a visual representation for a MAM-only deployment with MobileIron AppStation:lMAM-only with AppStationl

MAM-only with AppStation and MDM with other platform

MAM-only with AppStation
The following shows a MAM-only with AppStation deployment. MobileIron Cloud is set up for MAM-only. The
device is not managed, only apps on the device deployed through AppStation are managed.

MobileIron AppStation 72 for Android Guide for Administrators| 7

MAM-only with AppStation and MDM with other platform

FIGURE 1. MAM-ONLY DEPLOYMENT

MAM-only with AppStation and MDM with other platform
The following shows a device on which apps are managed by MobileIron Cloud and AppStation, while the device isalso managed with another MDM platform.

FIGURE 2. MAM-ONLY AND OTHER MDM ON A DEVICE

lDevice A is managed (MDM) by MobileIron Cloud.

MobileIron AppStation 72 for Android Guide for Administrators| 8

MobileIron AppStation configuration

lDevice B is not managed by your tenant of MobileIron Cloud. MobileIron AppStation is used for MAM-only.
The device can also be managed by MobileIron Core, another MobileIron Cloud tenant, or another MDM
provider .

MobileIron AppStation configuration
Configurations for MAM-only with MobileIron AppStation are created in MobileIron Cloud. MobileIron AppStationreceives the configurations when it registers with MobileIron Cloud.
Use the MAM Only configuration in MobileIron Cloud to set up AppStation. For an overview of the configurations
needed to set up AppStation see AppStation configuration steps overview.
lSupported configurations for managing apps through AppStationlAdministrator actions supported for AppStation

Supported configurations for managing apps through AppStation
The following configurations in Cloud are supported for managing apps through AppStation:lCertificatel

Identity Certificatel

AppConnectl

AppConnect appl

MobileIron Threat DefenselPrivacyl

VPNlWifi

IMPORTANT: MDM-related configurations other than the ones listed are not supported for MAM-onlydevices.
For information on setting up the configurations, see the MobileIron Cloud Administrator Guide.

Administrator actions supported for AppStation
The following administrator actions through AppStation are supported:l

Force check inl

RetirelSend messages

MobileIron AppStation 72 for Android Guide for Administrators| 93
Setting up MobileIron AppStation
The following describe the setup required for MobileIron AppStation for Android:l

AppStation configuration steps overview

lVerify the setup for AppStation

AppStation configuration steps overview
The configurations for AppStation are created in MobileIron Cloud. The following provides an overview of theconfiguration steps for deploying AppStation and pointers to the relevant content in the MobileIron Cloud
Administrator Guide:
1. Create a user group to distribute AppStation and manually add users to the group.
See Android AppStation and Android enterprise for MobileIron AppStation behavior on Android enterprisedevices.
See "Creating a manually managed user group" in the MobileIron Cloud Administrator Guide.
2. Create a dynamically managed device group with the rule "user group," which is equal to the user group
created for AppStation.
See "Adding a device group" in the MobileIron Cloud Administrator Guide.
NOTE: Devices previously enrolled for MDM in a Cloud tenant cannot be re-registered with thesame Cloud tenant using AppStation. To use AppStation, delete the devices from theCloud tenant, then register with the same Cloud tenant using AppStation.
3. Create a MAM Only configuration for AppStation and assign it to the dynamically managed device group
created for AppStation.
See Configuring MAM-only in MobileIron Cloud .
4. Add apps for distribution and assign the apps for distribution to the dynamically managed device group
created for AppStation.
See Add apps for distribution.
5. Notify users to download and register AppStation.
If Always require client registration is enabled in Users > User Settings > Device Registration
Setting in MobileIron Cloud, users automatically get emails for registering their device via AppStation.
Device users download AppStation to their device directly from the Google Play Store.
See What users see in MobileIron AppStation for Android for information about how device users canregister their devices to your MobileIron Cloud instance and install apps from AppStation.

MobileIron AppStation 72 for Android Guide for Administrators| 10Configuring MAM-only in MobileIron CloudConfiguring MAM-only in MobileIron Cloud
The MAM Only configuration in MobileIron Cloud allows you set up MAM-only for mobile devices.
Before you beginlMobileIron AppStation configurationl

AppStation configuration steps overview

Procedure
1. In MobileIron Cloud, go to Configuration > +Add.
2. Enter MAM only in the search box, then select the MAM Only configuration from the search results.
3. Enter a name for the configuration.
4. Click Next.
5. Select a distribution option for AppStation.
6. Click Done.
Next stepsl

Add apps for distribution

Add apps for distribution
You distribute apps to MAM-only devices through MobileIron Cloud. Do the following in MobileIron Cloud:1. Add the apps that you want to distribute to MAM-only devices.
2. Assign the apps for distribution to the dynamically managed devices group created for AppStation.
NOTE: AppConnect apps require additional AppConnect-related configurations as well.
See the MobileIron Cloud Administrator Guide for adding and configuring apps in MobileIron Cloud. Some relevant
sections are: "Adding an app from a public store," "Adding an In-house app," "Configuring AppConnect Devices,""Configuring AppConnect Apps."
IMPORTANT: Ensure that AppConnect apps are wrapped with Secure Apps Manager for AppStation.
AppConnect apps wrapped with the regular Secure Apps Manager will not work withAppStation. AppConnect apps wrapped with the regular Secure Apps Manager can be
pushed to AppStation. For information about wrapping AppConnect apps for Android, see
the MobileIron AppConnect for Android App Developers Guide.

MobileIron AppStation 72 for Android Guide for Administrators| 11

Verify the setup for AppStation

Verify the setup for AppStation
In MobileIron Cloud, go to Devices > Device Groups. Select the device group for AppStation to verify theconfigurations assigned to the group.

MobileIron AppStation 72 for Android Guide for Administrators| 12

4What users see in MobileIron AppStation forAndroidThe following provide information about the user experience with MobileIron AppStation:l

Download and install AppStation for Androidl

Register with MobileIron Cloudl

Launcher and Catalog

Download and install AppStation for Android
MobileIron AppStation is available in the Google Play Store. Search for MobileIron AppStation and follow theprompts to install the app on your device.

Register with MobileIron Cloud
When you first launch MobileIron AppStation, you are prompted to enter your username and password. Enter yourenterprise username and password to register with MobileIron Cloud. When you register with MobileIron Cloud, theCatalog with the list of available apps becomes available on your device.

FIGURE 3. REGISTER

MobileIron AppStation 72 for Android Guide for Administrators| 13

Launcher and Catalog

Launcher and Catalog
When you first launch AppStation, you see the welcome screen followed by prompts that take you through device
setup and installing the needed configurations. You are then prompted to install apps that are available to you.
Follow the prompts to install the apps. After the apps are installed the Launcher becomes available. The Launcher
displays the apps that are installed. If no apps are installed, an empty Launcher screen is shown.

FIGURE 4. LAUNCHER WITHOUT ANY APPS

Tap the catalog icon on the bottom right corner to see the apps available to you. The following indicate whether an
app is installed or not:l

Install: Indicates that the app is not yet installed.

lOpen: Indicates that the app is installed.

lUpdate: Indicates that updates are available for the installed app.

MobileIron AppStation 72 for Android Guide for Administrators| 14

Mobile Threat Defense

FIGURE 5. CATALOG WITH AVAILABLE APPS

To install an app, tap the app and follow the prompts. If the app is a public app, AppStation switches to the Google
Play Store to install the app. After installing the app, the toggle changes from Install to Open. Click Open to launch
the app.

Mobile Threat Defense
If Mobile Threat Defense (MTD) is configured, the MTD icon is seen in the top right corner of the screen inLauncher and Catalog. Tapping the MTD icon, takes you to Threat Status where you can see a detailed view ofthe threats specific to the device, network, and apps.

MobileIron AppStation 72 for Android Guide for Administrators| 15

Settings

FIGURE 6. MTD ICON

Tap on one of the options, Device Threats, Network Threats, or App Threats, to see details for each threat andhow to resolve the threat.

FIGURE 7. THREAT DETAILS

Settings
Swiping from the left reveals additional options. These options provide more information about the app, device, andthreat defense.

MobileIron AppStation 72 for Android Guide for Administrators| 16

Settings

FIGURE 8. ADDITIONAL MENU OPTIONS

Settings provides additional information about the app and access to app logs.

FIGURE 9. SETTINGS > ABOUT > DEVICE DETAILS

MobileIron AppStation 72 for Android Guide for Administrators| 17