Automated Actions. Table of Contents

Transcription

1 Automated Actions With Automated Actions, you can configure ZDM to execute actions based on user or device properties, events, or the existence of applications on devices. For example, you can configure the following actions to occur automatically in these situations: Ensure that user who have jailbroken or rooted their ios or Android devices get notified that they have breached company policy and that their devices will be selectively wiped if they do not bring their devices into compliance. Enforce a geo-fencing policy whereby if a user's device leaves a defined geographical perimeter, their device will be blocked from accessing corporate , selectively wiped, and/or revoked. Alert your users when their mobile devices are roaming domestically or internationally and that they may be charged extra for their service. Selectively wipe a user's device when they leave the company (their Active Directory account becomes disabled) so that they can no longer access corporate data. Place a user's device into an 'Out Of Compliance' state if the user installs a blacklisted app and send the user a notification informing them they have broken company mobile app policy. Note: Before you can use Automated Actions to send automated notifications, make sure you have configured Notifications Servers for SMTP and SMS so your message will be sent. Table of Contents 1. Table of Contents 2. Automated Action in a Nutshell 2.1. Automated Actions Caveats Location Services-Based Automated Action Triggers Why Are Some Notifications Not Being Sent? 2.2. Trigger Types Trigger Type Examples 2.3. Types of Automated Actions 2.4. Automated Actions Example - Blacklisted App Notification 2.5. Configure Notification Template System Macros in Automated Actions

2 2.6. Create a Blacklist for Words with Friends Free 2.7. Create an Automated Action to Notify User When Blacklisted App Installed 2.8. Deploy Automated Actions to Device 2.9. Notification Upon Install of Blacklisted App on IOS Device 3. Troubleshooting Automated Actions 4. Show Automated Actions Executions 5. Compliance with Automated Actions 5.1. Automated Action Deployment Package Naming/Ordering Recommended Deployment Package Ordering Example Compliance Reset Automated Action - Named 'aaa-ooc-reset' Location Services Automated Action - Named 'aab-location-services-disabled' Blacklisted App Automated Action - Named 'aac-blacklisted-app' Jailbreak Automated Action - Named 'aad-jailbreak'' Deployment Package Ordering Compliance Reset Deployment Package: Named '0-aaa-OOC-RESET' Location Services Deployment Package: Named '0-aab-location-services-disabled' Blacklisted App Deployment Package: Named '0-aac-blacklisted-app' Compliance Deployment Packages in Proper Order Automated Action in a Nutshell This example illustrates a simple automated Action inside ZDM that is configured to set a user's device as Out Of Compliance if a specific app (Facebook) is installed on it that violates company mobile app policy.

3 Automated Actions Caveats Before you start using Automated Actions, consider the following: Important! If devices are shared between two users, and you want to re-enroll the device to the another user, make sure that you delete the device entry from the ZDM Devices tab before enrolling the second user. Automated Actions are only triggered when a device connects to ZDM. For example, a notification will not be sent to a device until the device attempts a connection back to the server, or an AS connection is attempted by the user (for example, if a device is being blocked by the SMG) Automated Actions can be deployed to anonymous devices if the package is set to be deployed to anonymous users. The Notify (SMTP/SMS) Automated Actions can not be performed on anonymous (unauthenticated) users. Automated Actions cannot be executed on devices that are unmanaged (have been revoked, selective wiped, or not-enrolled) with the exception of the Notification and Set as Out Of Compliance actions. The Out Of Compliance action will keep a device in that state until another action explicitly changes the state of the Out Of Compliance property. The SMG block notification cannot be executed on an un-enrolled device. If you are using Automated Actions to detect when ios device users have disabled their location servers, e.g., you want to send a notification or selectively wipe or revoke a device when a user disables their device's location services, you need to be sure that you enable the "Report if location services are disabled" option when configuring an ios Geo-tracking policy. If you want to create an action based upon a user whose Active Directory account has been disabled, then use the Event Trigger named 'AD Disabled User' to trigger the Action.

4 Automated Actions and Notification Templates If you create custom Notification templates of the following type - Out of Compliance' and AD Disabled User these templates will not visible to select for Automated Notification. Location Services-Based Automated Action Triggers If you want to use the following device events - Location perimter breach and Location services disabled - to trigger an Automated Action, then be sure to do the following: 1. In the ios Location Services Policy dialog, make sure you check the option named 'Report if location services are disabled'. 2. Configure the Automated Action using a location service trigger, such as Location services disabled.

5 3. Connect to the device by sending a Location-based request, for example, Locate or Enable Tracking: Why Are Some Notifications Not Being Sent? Any ZDM-managed devices that are currently blocked by SMG, notifications will not be sent to those devices until those users initiate an Active Sync activity such as receiving an , or if the device syncs with Exchange Recurring Notifications will sometimes be a delayed due to the original event that causes the notification to be sent. For example, you might have a recurring notification being sent every one hour, but the notifications are not being received. Recurring notification will not be sent until configured trigger occurs again after Repeated Wait is expired. There is a default one hour wait period for Event-based triggers. Trigger Types Triggers are the states or events or properties that cause an automated action to occur. There are four categories Triggers, each of which contain multiple types: Device Property, User Property, Applications, Event. Trigger Type Examples Device Property Useful device properties you can use as triggers for automated actions:

6 Jailbroken or Rooted. If a user jailbreaks their devices, you can set an action to notify the user and if the user does not undo the jailbreak in a given amount of time, selectively wipe the device. Out Of Compliance: If a device is put into a state of being out of compliance, you can block that device from the SMG (and thus corporate ) and notify the user. Passcode compliant. If this trigger's condition is false, then you can set the device to Out Of Compliance or selectively wipe the device. Perimeter Breach: If the device leaves the geo-perimeter defined in an ios geo-fencing policy, this condition can set and used to notify the user, wipe the device, and so on. Many more: Look in the Automated Actions dialog to view all user properties. Useful user properties you can use as triggers for automated actions: User Property AD failed login attempts: If an Active Directory (AD) user attempts to log in more times that allowed, you can notify the user that they will have to wait a certain time period before they can try to log in again. Many more: Look in the Automated Actions dialog to view all user properties. Applications This trigger allows you to specify whether or not an app is installed on a device, by name, and then set an appropriate action such as notify or set the device as out of compliance. The following system events can be used as triggers in automated actions: Event SMG block: A user's device has been blocked by the Secure Mobile Gateway (SMG) and the device has lost access to corporate . Device unmanaged: The device has lost its ability to connect to and communicate with (and thus be managed by) the ZDM server. Device jailbroken: A user has broken the ios user agreement and warranty in order to install unauthorized software. Device not blacklist/whitelist app compliant: A user's device breaks an app blacklist or whitelist policy, you can choose an action to perform. Device revoked: The device has lost ability to connect to the ZDM server. Device international roaming: A user's device has started internationally roaming. Device domestic roaming: A user's device has started domestic roaming. Location perimter breach: A user's device has gone outside of Location services disabled: A user's device has had its location services disabled. AD-Disabled User If the user's Active Directory account has been disabled. E.g., when an employee leaves a company.

7 Types of Automated Actions The following list details the types of actions you can configure to occur automatically based on trigger type. Selective Wipe: Clears corporate data from the device while retaining personal information and selected settings. The MDM profiles and all packages pushed by Device Manager to the device are removed. The device can, however, be re-enrolled at a future time. Revoke: Revoking a device prohibits any further connection from the device. If the device attempts to connect to Device Manager, the MDM profile and all packages deployed to the device are removed. The device is barred from re-enrollment unless it is re-authorized by an administrator. Set as Out Of Compliance: The device will be given a property named Out of Compliance and will set it to True. When a device is Out Of Compliance (has this property set to true), then it appears as Out of Compliance on the Dashboard Alerts widget. Automated Actions Example - Blacklisted App Notification This example illustrates a basic example of using ZDM Automated Actions to set up an automatic notification to let a user know that they have installed a blacklisted app on their device. Most companies that manage user devices want to be sure that a work device only has the approved list of apps, and does not have any banned apps. For this example, you will perform the following tasks: Configure the notification template you want to send Create a Blacklist for a ios app named Word with Friends Free Create an Automated Action that sends a notification when a device violates a black list policy. Apply the Blacklist policy and deploy the Automated Actions to your device in a deployment package Install the Words with Friends for Free on your ios device Receive the Notification Configure Notification Template To make sure you send the right notification when your user's device has a blacklisted app installed, you will check the notification template for the message you will send ('Non Compliant Blacklist / Whitelist') is configured properly. Note: By default, all notification templates are configured to be sent to the ${user.mail} macro, which will use the address of the device owner that will receive the notification. If you want notificationn s to be sent to an admin user, for example, to notify an admin that a device has been jailbroken, you can enter the admin address in nthe To field. To configure your notification template:

8 1. Inside ZDM, click the Options link. 2. Select Notification Templates and then select the template named Non Compliant Blacklist / Whitelist. 3. Click Edit. 4. In the Notifictions Template dialog, Settings tab, make sure you have the right channels of communication selected.

9 5. Next, in the SMTP tab, make sure you enter a name or address in the From field. This is not mandatory, but it is recommended. You can also modify the Subject line and message, but do not modify the system macros (${user.mail}; ${firstnotnull(device.tel_number,device.serialnumber)}, etc.), or the message may not get sent properly. 6. Click Update. The Template is ready for the Automated Action. System Macros in Automated Actions For information on using system macros, and a list of those that can be used in Automated Actions, see Macros in Notification Templates and Automated Actions. Create a Blacklist for Words with Friends Free Next you will create a blacklist for an app, so you can use the blacklisted app as a trigger for your automated action later. To create an app blacklist: 1. In ZDM, select the Policies tab, and then from the left side select ios -> Blacklist, and then click New App. 2. In the Add a new application dialog, enter the following information: App Name: Words with Friends for Free

10 App bundle ID: com.zynga.wordswithfriendsfree 3. Click Create. 4. Next, apply the blacklist to ZDM by clicking Apply app list. Create an Automated Action to Notify User When Blacklisted App Installed In this task, you will create an Automated Action that will send a notification to users when a blacklisted app is installed on their device. To create an Automated Action: 1. In the Policies tab, select Global -> Automated Actions, and then click New. 2. In the New automated action dialog, enter the following information: Name: Blacklist Notify Trigger Type: Applications Name: Installed Condition: Is Value: WordsWithFriendsFree

11 Action: Notify Template: Non Compliant Blacklist / Whitelist Delay: 10 Minutes Repeat Wait: 1 Hours. This option allows you to delay the sending of a Notify action (a notification message) in the event that there is a break in nteh communication between the device and the ZDM server. 3. Click Create. Deploy Automated Actions to Device In this last task, you will create a deployment package that contains Automated Actions and then push that deployment to your device. Once on your device, you install the Blacklisted app (Words with Friends for Free) to trigger both the notification that your device is out of compliance, and to trigger the SMG block on the server. Best Practice: We strongly recommend that you create separate deployment packages for your Automated Actions and deploy them separately from other packages. Additionally, make sure you configure Deploy to anonymous users in the Groups of users page of the package, to capture those users who may have removed their agents, or who have had their AD account disabled. To deploy the automated action: 1. In ZDM, select the Deployment tab, and then click New Package -> New ios Package.

12 2. In the Create New Package wizard, Package Name window, enter a name for the Blacklist package - Blacklist Apps or something similar - and then click Next. 3. In the Groups of users window, select a group you want to deploy this policy to and then click Next. 4. In the Resources to be deployed window, under Available Resources scroll to the Automated Actions section and select the two Automated Actions you previously created in the last step. Then, click the right arrow to add the resource to the deployment package. 5. Next, scroll down further in the Available Resources list, near the bottom and select the Software Inventory resource, so ZDM can take an inventory of the installed software on the device and compare it with the Blacklist. Click the right arrow to add the resource to the deployment package and then click Next.

13 6. In the Deployment schedule window, select the If not deployed Start Now option. Click Next. 7. In the Deployment rules page, click Next. 8. In the Package summary page, click Finish. 9. From the packages list, click Deploy. When the deployment has finished, select the deployment package, and click the Details button to see information about the success of the package deployment. When the package shows as deployed, then you can move on to the next and step and install the Blacklisted app on you ios device. Notification Upon Install of Blacklisted App on IOS Device When the users targeted in the deployment install the blacklisted app on their ios device, Words with Friends Free, they will receive a notification. Troubleshooting Automated Actions To check whether or not automated notification was sent to a user, you can try a few things: Check the Deployment of the package that contained your Automated Action to make sure is actually deployed. Check the ZDM Device Event Log and see what if any of the events specified in your automated actions have executed. Check the ZDM Sent Notications Log and see which notifications have been sent, which have failed, who received them, when they were sent, and more.

14 Show Automated Actions Executions You can view all of the automated actions that have been executed from inside of ZDM at any time. To show the list of executed Automated Actions: 1. In ZDM, select the Policies tab and then select Show Executions. Compliance with Automated Actions Automated actions allow you to change the status of a device from a state of compliance to a state of non-compliance based upon specific conditions. For example, you can set an Automated Action to change a device to a state of Out Of Compliance=True if the device has been jailbroken/rooted, if the user disabled location services on the device, if the user installs a blacklisted application, and so on. In a cases where a user's device is put into an Out Of Compliance state (the device property Out of Compliance is = True), and then the user fixes the device to that the device is in compliance, you will need to configure a policy (deploy a package) that resets the device into a compliant state. In other words, you need to change the device property of Out Of Compliance = False. For example, let's say you want to define the following three compliance policies in your organization using ZDM Automated Actions:

15 1. Location Services Policy: This policy states that if a user disables location services on their device, then the Automated Action should then set the device property Out of Compliance to True (OCC=True). 2. Blacklisted App Policy: This policy states that if a user installs a blacklisted app on their device, then the Automated Action should then set the device property Out of Compliance to True (OCC=True). 3. Jailbreak Policy: This policy states that if a user jailbreaks their device, then the Automated Action should then set the device property Out of Compliance to True (OCC=True). Automated Action Deployment Package Naming/Ordering Because the manner in which ZDM deploys packages to target devices, you need to name your Automate Action compliance policies in a very specific way, so that they get executed in the proper order. ZDM deploys packages according to their name, deploying those packages in an alphanumeric order. Thus, in order to ensure that your Compliance Reset Automated Action package gets deployed first and doesn't reset any of the other Automated Action packages that are designed to track compliance device compliance. In order to configure your Automated Actions to detect device compliance, you need to ensure you name your Automated Actions so that the policies are deployed in a specific order, namely, you want to be sure the global compliance reset polices is deployed first, and then your subsequent Automated Action compliance deployment packages policies are executed after. Recommended Deployment Package Ordering Example In the example above where you want to create three packages to track device compliance, the Geofence, Blacklist, and Jailbreak polices. The Automated Actions will track the devices and set them to Out of Compliance=False when the user violates the policy. And, you want to be able to reset these devices when the user brings the device back into compliance. To order your compliance policies correctly: 1. Compliance Reset Automated Action - Named 'aaa-ooc-reset' This Automated Action resets the device property Out of Compliance=False on the devices of users targeted by the policy. It is given the name 'aaa-ooc-reset' so it will be executed before the policies that can set a device out of compliance.

16 2. Location Services Automated Action - Named 'aab-location-services-disabled' This Automated Action sets a device property to Out of Compliance=True if user disables location services on their device. It is given the name 'aab-location-services-disabled' with a delay of three minutes so it will be executed after the compliance reset Automated Action that comes before it.

17 3. Blacklisted App Automated Action - Named 'aac-blacklisted-app' This Automated Action sets a device property to Out of Compliance=True if user installs a blacklisted app on their device. It is given the name 'aac-blacklisted-app' with a delay of four minutes so it will be executed after the compliance reset Automated Action that comes before it. 4. Jailbreak Automated Action - Named 'aad-jailbreak'' This Automated Action sets a device property to Out of Compliance=True if user jailbreaks their ios their device. It is given the name 'aad-jailbreak' with a delay of five minutes so it will be executed after the compliance reset Automated Action that comes before it.

18 Deployment Package Ordering Your last step to ensure that your compliance policies will execute in the proper order is to create Deployment Packages using the same names you used for the Automate Actions. You will need to create deployment packages with naming such that the compliance reset package gets deployed first, followed by the other Automated Actions that evaluate devices for compliance. For example, if you wanted to create the set of set of Automated Actions compliance policies described in this example for ios devices, from the Deployment tab in ZDM you would create new for each of the listed Automated Actions using the following naming convention: 1. Compliance Reset Deployment Package: Named '0-aaa-OOC-RESET' Create a deplolyment package containing the compliance reset Automated Action using this name to ensure that this package will be deployed before your other compliance deployment packages.

19 2. Location Services Deployment Package: Named '0-aab-location-services-disabled' Create a deployment package for the location services Automated Action with this naming to ensure that it will be deployed after the compliance reset deployment package. 3. Blacklisted App Deployment Package: Named '0-aac-blacklisted-app' Create a deployment package for the blacklisted app Automated Action with this naming to ensure that it will be deployed after the compliance reset deployment package. 4. Jailbreak Deployment Package: Named '0-aac-jailbreak' Create a deployment package for the ios jaclbreak Automated Action with this naming to ensure that it will be deployed after the compliance reset deployment package.

20 When you deploy packages, you can be sure that the compliance packages are deployed first, and in the proper order. Compliance Deployment Packages in Proper Order 2012 Zenprise, Inc. All rights reserved. Updated: Fri, 15 Mar :20:26 GMT Powered by 20