Mobile Device Manager. Windows User Guide (Windows Phone 8/RT)

Transcription

1 Mobile Device Manager Windows User Guide (Windows Phone 8/RT) Document Revision Date: Oct. 22, 2014

2 Mobile Device Manager Windows Phone 8 User Guide i Contents Windows Phone 8 Features Matrix... 1 Overview... 2 Before You Begin... 2 Supported Devices, OS, Versions, and Agents... 2 Windows Phone 8 Device Enrollment... 3 Overview... 3 Enrollment Requirements... 3 Enrolling through the DM Client... 4 Completing the Enrollment... 4 Windows Phone 8 Device Profiles... 5 Overview... 5 Configuring General Profile Settings... 5 Deploying Passcode Payloads... 6 Deploying Restrictions Payloads... 7 Deploying Wi-Fi Payloads... 8 Configuring Virtual Private Network (VPN) Access... 9 Deploying Payloads Deploying Exchange ActiveSync Payloads Configuring Application Control for Windows Phone Configuring an Application Group Deploying a Credentials Profile Installing a Certificate on Windows Phone 8 Devices Configuring an SCEP Payload Creating an Assigned Access Profile Time Schedules Defining Time Schedules Applying a Time Schedule to a Profile Compliance Compliance Policies by Platform Adding a Compliance Policy Apps for Windows Phone

3 ii Overview Using the AirWatch Agent Managing Windows Phone 8 Devices Overview Using the Device Dashboard Using the Device List View Using the Management Tabs Using the Device Details Page Utilizing Reports Using the Hub Powered by

4 Mobile Device Manager Windows Phone 8 User Guide 1 Windows Phone 8 Features Matrix The following matrix shows what AirWatch features are available to the Windows Phone 8.0 and 8.1 platforms. Feature Windows Phone 8.0 Windows Phone 8.1 Activation & Enrollment Native Client Enrollment Agent Based Enrollment Native Enrollment with Web Dialog Force EULA/Terms of Use Acceptance Support for Option Prompts during Enrollment Active Directory/LDAP Messaging (Architecture) SMS Messages Push Notifications Real Time Profile and Command Delivery Security Policies & Commands Password Policy Lock, Ring, and Change Passcode Commands Enterprise Wipe Corporate Resource Provisioning & Exchange ActiveSync Wi-Fi VPN Root and CA Certificate Management Client Certificate Management (SCEP) 1 Device Restrictions and Settings 2 Application Management Silent App Installation Silent App Update Silent App Removal App Whitelisting and Blacklisting Assigned Access (Kiosk Mode) 3 AirWatch Applications AirWatch Browser Secure Content Locker Asset Tracking Asset Tracking Device Status IP Address Location Network Remote Management Support Send Support Message ( and SMS only) Change Device Passcode 1 While Windows Phone 8.0 supports SCEP credentials, the platform cannot install these certificates silently. End-user input is required. 2 Additional and varied restrictions and settings available on Windows Phone 8.1 than on Windows Phone Available through XML custom settings. Examples available in the Windows Phone 8 Platform Guide.

5 Mobile Device Manager Windows Phone 8 User Guide 2 Overview Windows Phone 8 is Microsoft's operating system designed for smartphones and shares the Modern UI with other Windows 8 devices. Windows Phone 8 offers a high level of user personalization, which makes it a good choice for those who want the dual benefits of corporate owned and bring-your-own-device (BYOD). Although it shares the modern UI design with other Windows devices, it is a distinct operating system and has unique management functionality. AirWatch can manage Windows Phone 8 devices from a central location. As an approved application in the phone's Device Management (DM) system, the AirWatch Agent can perform many device management functions that might not otherwise be available. For example, the AirWatch solution supports remote device configurations, including certificate based authentication for , as well as remote wipe commands and the installation of applications. NOTE: It is often necessary to differentiate between the Windows Phone 8.0 and Windows Phone 8.1, because Microsoft added many new MDM features to Windows Phone 8.1. If the topic refers to Windows Phone 8 devices, the topic applies to all versions of Windows Phone 8 devices. Before You Begin Prior to enrolling Windows Phone 8 devices, you should consider the following prerequisites, requirements, supporting materials, and helpful suggestions from the AirWatch team. Familiarizing yourself with the information available in this section prepares you for a successful deployment of Windows Phone 8 devices. Supported Devices, OS, Versions, and Agents The following is a comprehensive list of supported devices, OS, versions, and agents. Platforms and Devices Supported AirWatch supports the use of all Windows Phone 8 devices. Agents and Versions Supported The latest agent and version found on the Windows Phone Store or via AirWatch Resources (

6 Mobile Device Manager Windows Phone 8 User Guide 3 Windows Phone 8 Device Enrollment Overview Each Windows Phone 8 device in your organization's deployment must be enrolled before it can communicate with AirWatch and access internal content and features. This is facilitated with the AirWatch Agent. End users will be prompted for the Enrollment URL and Group ID, which must be provided to them by an administrator. Windows Phone 8 devices must begin communicating with AirWatch to access internal content and features, which is facilitated using the AirWatch Agent. Available for download from the Windows Store, the AirWatch Agent provides a single resource to enroll a device as well as provide device and connection details. NOTE: Windows Phone 8.1 devices use a different enrollment method than Windows Phone 8.0 devices. Enrollment Requirements Microsoft Developer's Account The AirWatch Admin must purchase an account, which consists of the following: o Windows Account ID This account (different from the Windows Live ID) costs a fee and enables your company to add applications to the Windows Phone Development Center. o Symantec Certificate Microsoft provides this code signing certificate in the Developer's package. You will use it for two purposes: To code sign the AirWatch agent.xap file. To generate an application enrollment token (AET) (.aetx file) that you upload into the AirWatch console, which is needed to distribute approved enterprise internal applications. For more information on this Enterprise Token, refer to the Mobile Application Management Guide. CAUTION: If you are considering the deployment of enterprise internal applications, make sure you generate and upload the AET before enrolling MDM devices. Otherwise, all devices enrolled before following the Mobile Application Management Guide will need to be re-enrolled again in order to access enterprise internal applications. AirWatch Agent This is the AirWatch agent.xap file for the company Hub required for Windows Phone 8.0 enrollment. Admin Console Credentials These credentials allow access to the AirWatch environment. Host Name This enrollment URL is unique to your organization's environment and is defined in the Admin Console. Group ID This ID associates your device with your corporate role and is defined in the AirWatch Admin Console.

7 Mobile Device Manager Windows Phone 8 User Guide 4 Enrolling through the DM Client NOTE: This enrollment method is for devices running Windows Phone 8.0 only. Devices running Windows Phone 8.1 must enroll using the Workplace enrollment. This simplified enrollment process for Windows Phone 8 begins with approving the AirWatch MDM Agent as a company application on the device you are enrolling. To do this, you must have credentials provided by the AirWatch administrator. Additionally, you must also know the server URL for the AirWatch environment into which you are enrolling your device. Next, to take full advantage of the device monitoring and management features and capabilities available for Windows Phone 8, you must also install the AirWatch MDM Agent, or Company Hub, following initial end user authentication. Additional information for AirWatch Administrators on uploading and enabling Company Hub can be found in Uploading and Enabling Company Hub. To enroll your Windows Phone 8 devices: 1. On your Windows Phone 8 Device, navigate to Settings > Company Apps. 2. Select Add Account. 3. Enter the Address and Password and then select Sign In. 4. Enter the server URL for the AirWatch environment into which you are enrolling. NOTE: If your administrator has enabled autodiscovery, then AirWatch authenticates your identity using the credentials you entered and you will not be prompted to enter the URL of the server. 5. Ensure the Install company app or Hub checkbox is selected and select Done. NOTE: If you are not using the AirWatch MDM Agent, you have completed enrolling the Windows Phone 8 device. Completing the Enrollment Following the next DM sync, which can be initiated manually or occurs about every minute automatically, the AirWatch MDM Agent appears as an installed app on the device. At this point, the device remains in a quarantined state in AirWatch until you launch the Agent on the device and complete any additional prompts the administrator has configured as required for enrollment. This may include accepting a Terms of Use agreement, specifying device ownership category, or simply proceeding past a Welcome screen. NOTE: If more than 10 minutes has elapsed between enrolling the device and launching the Agent for the first time, then a prompt asking for your credentials to access the application appears.

8 Mobile Device Manager Windows Phone 8 User Guide 5 Windows Phone 8 Device Profiles Overview You can associate devices with profiles via the Admin Console to help ensure the proper use of corporate owned devices and protection of sensitive data. You can think of profiles as the settings and rules that, when combined with compliance policies, help you enforce corporate rules and procedures. The individual settings you configure, such as those for Wi-Fi, virtual private network (VPN), and restrictions are referred to as payloads. It is recommended for profiles that only one payload is associated per profile, which means you will have multiple profiles for different settings you wish to establish. In addition to profiles, you can create compliance policies to detect Windows Phone 8-specific conditions and perform actions automatically. Configuring General Profile Settings The process for creating a profile consists of two parts. First, you must specify the General settings for the profile. The General settings determine how the profile is deployed and who receives it as well as other overall settings. Next, you must specify the Payload for the profile. The payload is the type of restriction or setting applied to the device when the profile is installed. As a best practice, it is recommended that you configure a single Payload per profile. NOTE: The following profile settings and options apply to most platforms and can be used as a general reference. However, some platforms may offer different selections. The general settings listed below apply to any profile: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select the appropriate platform for the profile you wish to deploy. Depending on the platform you select, the following settings may vary. 3. Configure General settings on the applicable tab. These include: Name Name of the profile to be displayed in the Admin Console. Version Read-only field that reports the current version of the profile as determined by the Add Version button. Description A brief description of the profile that indicates its purpose. Deployment Determines if the profile will be automatically removed upon unenrollment: o Managed The profile is removed. o Manual The profile remains installed until removed by the end user. Assignment Type Determines how the profile is deployed to devices: o Auto The profile is deployed to all devices automatically. o Optional Deployed to individual devices at the administrator's discretion. o Interactive When installed, these special types of profiles interact with external systems to generate data to send to the device. This option will only be available if enabled in Groups & Settings > All Settings > Devices & Users > Advanced > Profile Options. o Compliance The profile is deployed when the end user violates a compliance policy applicable to the device. Allow Removal Determines whether or not the profile can be removed by the device's end user: o Always The end user can manually remove the profile at any time.

9 Mobile Device Manager Windows Phone 8 User Guide 6 o o With Authorization The end user can remove the profile with the authorization of the administrator. Choosing this option adds a required Password field. Never The end user cannot remove the profile from the device. Managed By The Organization Group with administrative access to the profile. Assigned Smart Group The Smart Group to which you want the device profile added. Includes an option to create a new Smart Group which can be configured with specs for minimum OS, device models, ownership categories, organization groups, and more. See the AirWatch Mobile Device Management Guide for additional information. NOTE: While Platform is a criterion within a Smart Group, the platform configured in the device profile or compliance policy will always take precedence over the Smart Group's platform. For instance, if a device profile is created for the ios platform, the profile will only be assigned to ios devices even if the Smart Group includes Android devices. Exclusions If Yes is selected, a new field Excluded Smart Groups displays, enabling you to select those Smart Groups you wish to exclude from the assignment of this device profile. View Device Assignment After you have made a selection in the Assigned Smart Group field, you may select this button to preview a list of all devices to which this profile will be assigned, taking the Smart Group assignments, and exclusions into account. Additional Assignment Criteria These check boxes enable additional restrictions for the profile: o Enable Scheduling and install only during selected time periods Specify a configured time schedule in which devices receive the profile only within that time-frame. Selecting this option adds a required field Assigned Schedules. See Time Schedules for more information. Removal Date The date the profile will be removed from the device. Must be a future date formatted as M/D/YYYY. 4. Configure a Payload for the device platform. 5. Select Save & Publish. Deploying Passcode Payloads This payload requires users to protect their devices with passcodes each time they return from an idle state. This action ensures that all sensitive corporate information on managed devices remains protected. Consider the complexity of the passcode. Set simple passcodes so that users can quickly access device content or set complex alphanumeric passcodes to secure the device content. To enforce a Passcode profile, follow the steps detailed below: 1. Navigate to Devices > Profiles > List View and select Add and then 2. Select Windows Phone Configure General settings for the profile. 4. Select the Passcode profile. 5. Configure the Passcode settings, including: Maximum Passcode Age Enforce users to renew passcodes at selected intervals. Maximum Number of Failed Attempts Reset the device to factory defaults if too many unsuccessful attempts have been made. Max Inactivity Time Device Lock Secure idle devices with short lock times. The time set here is the

10 Mobile Device Manager Windows Phone 8 User Guide 7 maximum amount of a time before the device will require a passcode to be entered. End users may shorten that time in the device settings but cannot lengthen the time past the amount entered in this payload. 6. Select Save & Publish when you are finished to push the profile to devices. Deploying Restrictions Payloads Deploy a restrictions payload for added security on Windows Phone 8 devices. Restrictions payloads for Windows Phone 8 devices can disable access to the SD card so unauthorized users cannot transfer sensitive data off the SD card. NOTE: Windows Phone 8.0 does not support the same restrictions as Windows Phone 8.1. Check the version badges to the right of every restriction option in the Admin Console. To enforce a Restrictions profile, follow the steps detailed below: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the Restrictions profile. 5. Configure the Restrictions settings, including: Administration o Allow User To Reset Phone Allow the end user to factory reset their device. o Allow Manual MDM Enrollment Allow the end user to enroll into AirWatch through the Workplace Enrollment. Security and Privacy o Allow Location Allow the use of location services. o Allow Microsoft Account Connection Allow the use of MSA accounts for non- related connection authentication and services. o Allow Adding Non-Microsoft Accounts Manually Allow the end user to add accounts such as Facebook or Twitter manually. o Allow Manual Root Certificate Installation Allow end user to manually install root and intermediate CAP certificates. o Allow Developer Unlock Allow developer unlock to be used on the device. Device Functionality o Allow Camera Allow end users to access the camera function of the device. o Allow Screen Capture Allow end users to take screenshots of the device. o Allow Storage Card Allow the use of a SD card. o Require Device Encryption Encrypt all data being stored to the SD card to prevent an end user from accessing readable, sensitive information. IMPORTANT: If you select this feature, you cannot return to not encrypting device data on the SD card by simply deselecting the checkbox. In order to return the device to that state, you would need to restore the device to factory settings (i.e., device wipe). o Allow Browser Allow end users to use the native Internet Explorer browser.

11 Mobile Device Manager Windows Phone 8 User Guide 8 o o o o o o o o o o o o o o Allow App Store Allow access to the app store. Allow Voice Recording Allow the end users to record voice recordings. Allow Cortana Allow access to the Cortana application. Allow Copy and Paste Allow the end user to copy and paste on the device. Allow Bluetooth Allow the connection of devices through Bluetooth. Allow Telemetry Allow the device to send telemetry information (such as SQM or Watson) to the Admin Console. Allow NFC Allow the use of the Near Field Communication chip on the device. Allow USB Connection Allow desktop to access phone storage via USB. Both MTP and IPoUSB are disabled when this restriction is enforced. Allow Search to Use Location Allow end user searches to use the device location services. Require Strict Safe Search Require searches to use the strict safe search setting. Allow Storing of Vision Search Images Allow the storage of Vision Search images onto the device. Allow Sharing Office Files Allow end users to share Office files. Allow Sync Settings Between Devices Allow end users to sync their settings preferences between Windows Phone 8.1 and Windows 8.1/RT devices. Allow Action Center Notifications Allow app and device notifications to display in the Action Center of the device. Network o Allow Wi-Fi Allow end users to connect to Wi-Fi. o Allow Manual Wi-Fi Configuration Allow connections to Wi-Fi outside of the MDM server installed networks. o Allow Wi-Fi Hotspots Reporting Allow Wi-Fi Hotspots information reporting to Microsoft. Once disallowed, the user cannot turn on this function. o Allow Internet Sharing Allow Internet sharing between devices. o Allow VPN over Cellular Allow the device to create a VPN over cellular networks. o Allow VPN Roaming over Cellular Allow the device to create a VPN while roaming over cellular networks. o Allow Cellular Data Roaming Allow cellular data usage while roaming. 6. Select Save & Publish when you are finished to push the profile to devices. Deploying Wi-Fi Payloads Configuring a Wi-Fi profile lets devices connect to corporate networks, even if they are hidden, encrypted, or password protected. This can be useful for end users who travel to various office locations that have their own unique wireless networks or for automatically configuring devices to connect to the appropriate wireless network while in an office. To configure a Wi-Fi payload, follow the steps detailed below: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the Wi-Fi profile.

12 Mobile Device Manager Windows Phone 8 User Guide 9 5. Configure the Wi-Fi settings, including: Name Enter the name (SSID) of the desired Wi-Fi network. Service Set Identifier Enter an identifier that is associated with the Name (SSID) of the desired Wi-Fi network. Connection Type Use the drop-down menu to select Extended Service Set as the Wi-Fi connection type. Security Type Use the drop-down menu to select the security type (e.g., WPA2 Enterprise) for the Wi-Fi network. Encryption - Use the drop-down menu to specify if data transmitted using the Wi-Fi connection is encrypted using Temporal Key Integrity Protocol (TKIP) or Advanced Encryption Standard (AES). Password Enter the password required to join the Wi-Fi network. Select the Show characters check box to disable hidden characters within the field. Identity Certificate Select (if desired) an Identity Certificate from the drop-down if you require the end user to pass a certificate in order to connect to Wi-Fi, otherwise select None (default). For more information needed to select a certificate for this payload, see Deploying Credentials Payloads. 6. Select Save & Publish to push the profile to devices. Configuring Virtual Private Network (VPN) Access Virtual private networks (VPNs) provide devices with a secure and encrypted tunnel to access internal resources. VPN profiles enable each device to function as if it were connected through the on-site network. Configuring a VPN profile ensures end users have seamless access to , files, and content. NOTE: This payload is only available to devices using Windows Phone 8.1. If you wish to use this payload, you must download and install the free update. To create a base VPN profile: 1. Navigate to Devices > Profiles > List View > Add. 2. Select Windows Phone Configure General profile settings as appropriate. 4. Select the VPN payload. 5. Configure VPN settings, including: VPN Name Enter the name of the connection name to be displayed. Server Enter the hostname or IP address of the server to which to connect. Tunnel Type Select the type of VPN tunnel you wish to use. DNS Suffix Enter the DNS suffix for your VPN. Authentication Type Select the type of authentication from the drop-down menu. o Certificate Select the Certificate created with the Certificate or SCEP profile. Proxy Select whether you wish to allow a manual proxy, a bypass for local, or none. Policies Select the checkbox if you wish to enable any of the following policies. o Remember Credentials Enable to allow end users to save their credentials. o Split Tunnel Enable to allow end users to use a split tunnel VPN. o Bypass For Local Allow users to bypass the proxy server for local addresses. o Trusted Network Detection Enable to use Trusted Network Detection when connection to

13 Mobile Device Manager Windows Phone 8 User Guide 10 o VPN. Connection Type Select the connection type you wish to allow. Secured Resources Select if you wish to control what resources may have access to the VPN. o Allowed Apps Add applications that are allowed access through the VPN. o Allowed Networks Add networks that are allowed access through the VPN. o Allowed Name Spaces Add name spaces that are allowed access through the VPN. o Excluded Apps Add apps that are not allowed access through the VPN. o Excluded Networks Add networks that are not allowed access through the VPN. o Excluded Name Spaces Add name spaces that are not allowed access through the VPN. o DNS Suffix Search List Add DNS suffixes to search for when connecting to the VPN. 6. Select Save & Publish. Deploying Payloads This payload configures user IMAP/POP3 accounts and sends configurations directly to their devices. Consider the following options while setting payloads: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the profile. 5. Configure the Wi-Fi settings, including: Maximum Attachment Size Control the size of IMAP/POP3 attachments to manage bandwidth on your mobile network. Use SSL Use the Secure Socket Layer (SSL) protocol to encrypt incoming and outgoing IMAP/POP3 s on the mobile network. Enable Authentication Secure IMAP/POP3 traffic on devices by enforcing authentication to access these accounts. 6. Select Save & Publish to push the profile to devices. Deploying Exchange ActiveSync Payloads This payload allows users to access corporate push-based infrastructures. Use this payload to set the sync frequency for calendar and systems. You can use identity certificates or public key certificates with the Exchange ActiveSync payload. If supported by the network, this profile can include ad-hoc certificate requests, too. To configure Exchange ActiveSync payloads, follow the steps detailed below: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the Exchange ActiveSync profile. 5. Configure the Wi-Fi settings, including: Exchange ActiveSync Host Enter the public host name or server name hosting your Exchange ActiveSync.

14 Mobile Device Manager Windows Phone 8 User Guide 11 Use SSL Select to send all information through the Secure Socket Layer. Login Information o Domain Enter the end-user's domain. o Username Enter the end-user's username. o Address Enter the end-user's address. o Password Enter the password for the end user. o Identity Certificate Select (if desired) an Identity Certificate from the drop-down if you require the end user to pass a certificate in order to connect to the Exchange ActiveSync, otherwise select None (default). For more information needed to select a certificate for this payload, see Deploying Credentials Payloads. Settings o Next Sync Interval (Min) Enter the number of minutes between syncs. o Past Days of Mail to Sync Select the number of days worth of past mail to sync with device. o Diagnostic Logging Select the type of diagnostic logging you wish to gather. Content Type o Allow Sync Allow the syncing of . o Allow Contacts Sync Allow the syncing of contacts. o Allow Calendar Sync Allow the syncing of calendars. 6. Select Save & Publish to push the profile to devices. Configuring Application Control for Windows Phone 8.1 NOTE: This payload is only available to devices using Windows Phone 8.1. If you wish to use this payload, you must download and install the free update. To allow or prevent installation of applications on devices, you can enable Application Control to whitelist and blacklist specific applications. While the Compliance Engine sends alerts and takes administrative actions when a user installs or uninstalls certain applications, Application Control prevents users from even attempting to make those changes. For example, prevent a certain game application from ever installing on a device, or allow only specific apps you've whitelisted to be installed on a device. Blacklisted apps installed on the device before the Application Control payload is pushed to the device will be disabled once the profile is pushed. 1. Navigate to Devices > Profiles > List View > Add. 2. Select Windows Phone Configure General profile settings as appropriate. 4. Select the Application Control payload. 5. Enable or disable the following settings to set the level of control for your application deployments: Enable Prevent Installation of Blacklisted Apps to enforce the automatic removal and/or prevent the installation of blacklisted apps defined in Application Groups. Enable Only Allow installation of Whitelisted Apps to prevent the installation of any application that is not a whitelisted app defined in Applications Groups. 6. Select Save & Publish. NOTE: If you update your Application Group after publishing the profile, you must republish the profile for it to take effect on devices. NOTE: For instructions on creating application groups, see Configuring an Application Group.

15 Mobile Device Manager Windows Phone 8 User Guide 12 Configuring an Application Group The Admin Console provides the ability to group applications into blacklisted, whitelisted, and required applications. These groups are called Application Groups and you push these lists using Organization Groups and user groups. Application groups control applications that you allow devices to install, prevent devices from installing, and require devices to install. 1. Navigate to Apps & Books > Applications > Settings > App Groups. 2. Select Add Group. 3. Complete options on the List tab: Select Type as Whitelist, Blacklist, Required, or MDM Application. NOTE: Select MDM Application if your goal is to group custom MDM applications. Select Platform as Apple, Android, or Windows Phone 8. Enter the Application Name and search for the application in the app store. Review the Application ID that automatically completes when you use the search function to search for the app from an app store. Select Add Application to add multiple applications and then select Next to navigate to the Assignment tab. Add exceptions to your application group to create detailed whitelists, blacklists, and required lists. Select Add Publisher for Windows Phone 8 to add multiple publishers to application groups. Publishers are organizations that create applications. Combine this option with Add Application entries to create exceptions for the publisher entries for detailed whitelists and blacklists on Windows Phone 8. Select Next to navigate to an application control profile. You must complete and apply an application control profile for Windows Phone Complete options on the Assignment tab: Enter a Description for the application group. Define the Device Ownership as Corporate-Dedicated, Corporate-Shared, Employee Owned, or

16 Mobile Device Manager Windows Phone 8 User Guide 13 Undefined. Assign the device Model and the Operating System. Select the Organization Group and User Group for the application group to be assigned to and then 5. Select Finish to complete the process. Deploying a Credentials Profile Even if you protect your corporate , Wi-Fi, and VPN with strong passcodes and other restrictions, your infrastructure still remains vulnerable to brute force and dictionary attacks, in addition to employee error. For greater security, you can implement digital certificates to protect corporate assets. To do this, you must first define a certificate authority, and then configure a Credentials payload alongside your EAS, Wi-Fi, or VPN payload. Each of these payloads has settings for associating the certificate authority defined in the Credentials payload. NOTE: Windows Phone 8.0 or 8.1 devices using the Credentials payload to push Personal Certificates need the AirWatch MDM Agent downloaded. End users will be required to install any certificates as mentioned in Installing a Certificate on Windows Phone 8 Devices. Root and Intermediate Certificates install silently to the device without end user interaction or the agent. To push certificates down to devices, you need to configure a Credentials payload as part of the profiles you created for EAS, Wi-Fi, and VPN settings. Use the following instructions to create a certificate-enabled profile: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the Credentials profile. 5. Configure the Credentials settings, including: Credential Source Upload a certificate from your local machine or define a Defined Certificate Authority. o If you choose to Upload your certificate, complete the following: Credential Name Enter the name of the credential or select on the information symbol to view acceptable lookup values like { Domain} and {DeviceModel} to find the credential file to use. Upload Upload the new certificate or lookup values. o If you choose to use a Defined Certificate Authority, complete the following: Certificate Authority for the Defined Certificate Authority Select the external or internal CA issuing encryption keys for the PKI. Certificate Template for the Defined Certificate Authority Select the predefined template for the CA to use when requesting a certificate. Certificate Store Select the store on the device where the certificate is located. Choose from Personal Certificates, Intermediate Certification Authorities Store, or EAS Certificate. NOTE: Root and Intermediate Certificates silently install to the device without interaction from the end user. Personal Certificates cannot be installed silently and required end user interaction. See the Installing a Certificate on Windows Phone 8 Devices section for more information. 6. Select Save & Publish when you are finished to push the profile to devices.

17 Mobile Device Manager Windows Phone 8 User Guide 14 Installing a Certificate on Windows Phone 8 Devices To install a credential on a Windows Phone 8 device, follow the steps detailed below: 1. Open the AirWatch MDM agent on the device. 2. Navigate to the My Device section of the agent. 3. Tap the Contextual menu (three dots) at the bottom right corner of the screen. 4. Tap Install certificate(s). The Certificate(s) screen displays, listing all the certificates the AirWatch Admin pushed in a payload to that device, as shown. NOTE: If the certificate contains a password, a Copy Password button displays; this copies the password to the device's clipboard. NOTE: If the certificate does not display, verify it was pushed to the device from the Admin Console. 5. Tap the Install Certificate button shown under the certificate you want to install on the device. If the certificate does not require a password, the certificate installs. Otherwise, the device advances to the Install Certificate? screen as shown. 6. If you copied a certificate password, tap the Paste button located to the left side of the screen. This inserts the certificate password you copied from the device's clipboard into the Password field as shown. 7. Tap Done. The Your certificates are installed screen displays. 8. Tap Ok. The certificate is now installed on the device and displays on the Certificate(s) page of the device. Installation is successful when the device user can authenticate their client with their Exchange server.

18 Mobile Device Manager Windows Phone 8 User Guide 15 Configuring an SCEP Payload Even if you protect your corporate , Wi-Fi, and VPN with strong passcodes and other restrictions, your infrastructure still remains vulnerable to brute force and dictionary attacks, in addition to employee error. For greater security, you can implement digital certificates to protect corporate assets. Simple Certificate Enrollment Protocol (SCEP) profiles allow you to silently install these certificates onto devices without the need of end-user interaction. To do this, you must first define a certificate authority, and then configure an SCEP payload alongside your Wi-Fi, VPN, or EAS payload. Each of these payloads has settings for associating the certificate authority defined in the SCEP payload. NOTE: SCEP profiles are for Windows Phone 8.1 devices only. To push certificates down to devices, you need to configure an SCEP payload as part of the profiles you created for EAS, Wi-Fi, and VPN settings. Use the following instructions to create a certificate-enabled profile: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the SCEP profile. 5. Configure the SCEP settings, including: Credential Source This drop-down menu is always set to Defined Certificate Authority. Certificate Authority Select the certificate authority you wish to use. Certificate Template Select the template available for the certificate. 6. Configure the Wi-Fi, VPN, or EAS profile. 7. Select Save & Publish when you are finished to push the profile to devices. Creating an Assigned Access Profile The Assigned Access profile allows you to limit access to specific functions and control features of Windows Phone 8.1 devices. By using this profile, you can control the apps displayed on the front page or app list, the settings accessed, and the function of each hardware key. To create an Assigned Access profile, follow the steps detailed below: 1. Navigate to Devices > Profiles > List View and select Add. 2. Select Windows Phone Configure General settings for the profile. 4. Select the Assigned Access profile. 5. Configure the Application List settings: Application Name Select the application you want to configure. Adding this application will control whether the app is available on the device. Pin to Start Enable to pin the Live Tile to the Start screen. If the app is added but not pinned, it appears on the app list. Size Select the size Live Tile used on the front page. X Set the X-axis location of the Live Tile. Y Set the Y-axis location of the Live Tile.

19 Mobile Device Manager Windows Phone 8 User Guide Configure the System Settings Menu settings by setting each option to Enabled or Disabled. This allows or disallows access to the system settings. 7. Configure the Application Settings Menu settings by setting each option to Enabled or Disabled. This allows or disallows access to the application's specific settings. 8. Configure the Hardware Keys settings by setting each option to Enabled or Disabled. This allows or disallows use of each hardware key. Remap Enable to display a drop-down menu containing remapping options for each hardware key. 9. Configure the Utilities settings by setting each option to Enabled or Disabled. This allows or disallows use of each utility. Start Menu Grid Layout Choose the layout option for the start screen. This controls the number of columns visible on the start menu. High resolution devices will have the option of four or six columns, while lower resolutions display four columns. 10. Select Save & Publish when you are finished to push the profile to devices. Time Schedules Time Schedules enable you to control when each device profile is active. Configure and apply time schedules to restrict when profiles are active on the device. Applying time schedules to profiles secures your corporate resources by only allowing employees access during the specific days and time frames. Conversely, applying time schedules can also limit personal content and access during work hours. Defining Time Schedules To create a time schedule: 1. Navigate to Devices > Profiles > Settings > Time Schedules. 2. Select Add Schedule to launch the Add Schedule window. 3. Enter a name for the schedule in the Schedule Name field. 4. Select the applicable Time Zone using the drop-down menu. 5. Select the Add Schedule hyperlink. 6. Select the Day of the Week, Start Time, and End Time using the applicable drop-down menus.

20 Mobile Device Manager Windows Phone 8 User Guide 17 You can also select the All Day check box to disable start and end times for the schedule. To remove a day from the schedule, select the applicable X under Actions. 7. Repeat steps 5 and 6 as many times as is necessary to Add more days to the schedule. 8. Select Save. Applying a Time Schedule to a Profile Once you have defined a time schedule, you can apply it to a profile and combine it with other payloads to create more robust profiles. For example, you can define time schedules for the normal work hours of different organization groups and add a Restrictions payload that denies access to the Game Center, multiplayer gaming, or YouTube content based on ratings and other settings. Once activated, the employees of the Organization Group to whom the profile was applied will no longer have access to these functions during the specified times. 1. Navigate to Devices > Profiles > List View > Add and select your platform. 2. Select Enable Scheduling and install only during selected time periods on the General tab. An Assigned Schedules box displays. 3. Enter one or multiple Time Schedules to this profile. 4. Configure a payload, such as Passcode, Restrictions, or Wi-Fi that you want to apply only while devices are inside the timeframes. 5. Select Save & Publish.

21 Mobile Device Manager Windows Phone 8 User Guide 18 Compliance The Compliance Engine is AirWatch's automated tool to ensure all devices adhere to your policies. Your policies may include basic security settings such as requiring a passcode and having a minimum device lock period. You may also decide to set password strength, blacklist certain apps, and require device check-in intervals to ensure devices are safe and in-contact with the AirWatch servers. Once configuration is complete and devices are out of compliance, the Compliance Engine begins to warn the user to fix compliance errors to prevent disciplinary action on the device. For example, if a user loads blacklisted games or social media apps onto their device, the Compliance Engine sends a message to notify the user that their device is out of compliance. If the errors are not corrected in the amount of time specified, the device loses access to certain content and applications. You may even automate the escalation process if corrections are not made. Lock down the device and notify the user to contact you to unlock the device. These escalation steps, disciplinary actions, grace periods, and message are all completely customizable with the Admin Console. Enforcing mobile security policies is as easy as: Choosing your platform Determine on which platform you want to enforce compliance: Android, Apple ios, Apple Mac, Windows Mobile, Windows PC, Windows Phone 8, or Windows 8/RT. Building your policies Customize your policy to cover everything from application list, compromised status, encryption, model and OS version, passcode, and roaming. Defining escalation Configure time-based actions in minutes, hours, or days and take a tiered approach to those actions. Specifying actions Send SMS, , or push notifications to the user's device or send an only to an Administrator. Request device check-in, remove or block specific profiles, install compliance profiles, remove or block apps, and perform an enterprise wipe. Configuring assignments Assign your compliance policy by organization group, Smart Group, and confirm the assignment by device.

22 Mobile Device Manager Windows Phone 8 User Guide 19 Compliance Policies by Platform The supported compliance policies by Platform are as follows: Compliance Policy Android Apple ios Mac OS X Windows Mobile Windows PC (Win32) Windows Phone 8 Windows 8/RT Application List Antivirus Status Cell Data Usage Cell Message Usage Cell Voice Usage Compromised Status Device Last Seen Encryption Firewall Status Free Disk Space Interactive Certificate Profile Expiry Last Compromised Scan MDM Terms of Use Acceptance Model OS Version Passcode SIM Card Change Windows Automatic Update Status Windows Copy Genuine Validation

23 Mobile Device Manager Windows Phone 8 User Guide 20 Compliance Policies Detailed Application List Detect specific, blacklisted apps that are installed on a device, or detect all apps that are not whitelisted. You can either specifically prohibit certain apps, such as social media or entertainment apps, or specifically permit only the apps you specify, such as internal applications for business use. Antivirus Status Detect whether or not an antivirus program is running. Compromised Status Select if the device is non-compliant when compromised. Prohibit the use of jail-broken devices that are enrolled with AirWatch. Jail-broken devices strip away integral security settings and may introduce malware in your network and provide access to your enterprise resources. Monitoring for compromised device status is especially important in BYOD environments where employees have various versions of devices and operating systems. For more information, refer to the Detecting Compromised Devices document. Device Last Seen Select if the device is non-compliant when the device fails to check in within an allotted time window. Encryption Select if the device is non-compliant when Encryption is not enabled. Firewall Status Detect whether or not a firewall program is running. Free Disk Space Detect the available storage space on the device. Interactive Profile Expiry Select if the device is non-compliant when an installed profile expires within the specified length of time. Last Compromised Scan Select if the device is non-compliant when AirWatch is unable to successfully query the device on schedule. MDM Terms of Use Acceptance Select if the device is non-compliant when the current MDM Terms of Use have not be accepted by the end user within a specified length of time. Model Select if the device is non-compliant based on a specific platform. OS Version Select if the device should be marked as non-compliant when it is within a certain window of OS versions that you configure. Passcode Select if the device is non-compliant when a passcode is not present. SIM Card Change Select if the device is non-compliant when the SIM Card has been replaced. Windows Automatic Update Status Detect whether or not Windows Automatic Update has been activated. Windows Copy Genuine Validation Detect whether or not the copy of Windows currently running on the device is genuine.

24 Mobile Device Manager Windows Phone 8 User Guide 21 Adding a Compliance Policy Follow the steps below to set up and initiate the Compliance Engine, complete with profiles and automated escalations: 1. Navigate to Devices > Compliance Policies > List View and select Add. The Add Compliance Policy screen appears. 2. Select a Platform on which to base your compliance policy. Choosing a Platform at the beginning means the available listing of rules, escalations, and actions will be Platform-specific. NOTE: Windows Mobile compliance is only supported on Motorola devices (compliance can only be enforced by the Enterprise Reset action). Once a platform is selected, the Rules tab displays. 3. Select Any or All rules in the Match field to detect conditions. 4. Choose the rule from the drop-down field and set specific rule parameters. Add more rules and parameters by selecting the Add Rule button. When finished building rules for this policy, select Next and the Actions tab displays.

25 Mobile Device Manager Windows Phone 8 User Guide Specify Actions and Escalations that occur. Select the type of action to perform: Application, Command, Notify, Profile, or . NOTE: For Mac OS X, you can only perform the following actions: Enterprise Wipe, Send to User, Send Push Notification to Device, Send to Administrator, Block/Remove Profile, Block/Remove Profile Type, and Block/Remove All Profiles. 6. Add more actions and parameters by selecting the Add Escalation button. When adding escalations, it is a best practice to increase the security of actions with each additional escalation. NOTE: The Block action applies if you are using Mobile Management and the Compliance Engine, which is accessed by navigating to > Compliance Policies > Policies. This lets you use Device Compliance policies such as blacklisted apps in conjunction with any Compliance Engine policies you configure. With this action selected, compliance is triggered with a single device policy update if the device falls out of compliance. You can enforce application compliance as well by establishing a whitelist, blacklist or required list of applications. For more information on establishing a robust and effective Mobile Application Management (MAM) plan, see the AirWatch MAM Guide. When finished building actions for this policy, select Next and the Assignment tab displays.

26 Mobile Device Manager Windows Phone 8 User Guide Select the Organization Group by which this compliance policy will be managed in the Managed By field. 8. Choose one or more Smart Groups by completing the Assigned Smart Groups field. 9. Decide if you want to exclude any Smart Groups by selecting Yes on the Exclusions field and select from the available listing of Smart Groups to exclude in the Excluded Smart Groups field. NOTE: While Platform is a criterion within a Smart Group, the Platform configured in the device profile or compliance policy will always take precedence over the Smart Group's platform. For instance, if a device profile is created for the ios platform, the profile will only be assigned to ios devices even if the Smart Group includes Android devices. 10. You may optionally select the View Device Assignment button to see a listing of devices affected by this compliance policy assignment. When finished determining the Assignment of this policy, select Next. The Summary tab displays. 11. In this final step, provide a Name and a useful Description of the compliance policy. 12. Complete the process by selecting Finish, which will save your compliance policy without activating it to the assigned devices or Finish And Activate, which will save and apply the policy to all affected devices.