CUSTOMER Android for Work Quick Start Guide

Transcription

1 Mobile Secure Cloud Edition Document Version: CUSTOMER

2 Content 1 Introduction to Android for Work Prerequisites Setting up Android for Work (Afaria) Setting up Android for Work (Mobile Secure, New Setup) Configuring Android for Work (Mobile Secure, Existing Setup) Creating a Configuration Policy for Android for Work Google Chrome Page Exchange Account Policy Page Restrictions Page Security Page WiFi Page Creating an Application Policy for Android or Android for Work Google Play Apps Adding an Android Application from a Commercial App Store Enrolling an Android Device SAP SE or an SAP affiliate company. All rights reserved. Content

3 1 Introduction to Android for Work Android for Work allows you to securely separate business and personal data and applications on your tablet or smartphone. This document forms part of both the Afaria 7 SP6 document set and the Mobile Secure document set and therefore refers to both products. Make sure you follow the instructions for your specific product. Android for Work provides the following: A secure mobile experience Easy to manage All the apps you need A dedicated work profile, hardware-based encryption and sharing restrictions ensure business data - calendars, contacts, files and apps - are separate and safe from malware while personal information stays private. IT has full control of all work related policies, profiles and data - from distributing apps to wiping business information - and the standard Enterprise Mobility Management (EMM) framework delivers a consistent experience across all devices. Find and deploy business apps easily with Google Play and create apps quickly with the Android app framework. Seamlessly integrate with existing IT systems such as Microsoft Exchange, IBM s, and Google Apps for Work. This guide provides you with all the information you need so that you can quickly: Acquire a Google domain and enterprise token to enable Android for Work functionality Create and deploy Android for Work applications Update the Mobile Device management console to support Android for Work Enroll Android devices using SAP Mobile Place Introduction to Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 3

4 2 Prerequisites In order to set up and use Android for Work you need the following: Prior Afaria administration experience From Google: A Google domain A Google Admin account The following capabilities: Users: Access to the Mobile Device Management Administration console with administrator privileges The ability to create Enrollment and Configuration policies A managed user account An Android device running Android 5+ (full support) or 4.0+ (support with some limitations). Refer to the Release s for the latest information on supported devices SAP SE or an SAP affiliate company. All rights reserved. Prerequisites

5 3 Setting up Android for Work (Afaria) If you are setting up your Afaria account to use Android for Work for the first time, you must register your Afaria domain with Google. You can start deploying Android Work Apps after completing the setup. Prerequisites We strongly recommend that you use a text editor, to copy and paste information from the Google website to the Afaria admin portal, as described in the steps below. The specific information to be copied consists of: Google account administrator credentials: Username (in the form of an address) Password Google enterprise token Google Client ID Google service account address p12 key passphrase Context Setup consists of: Verifying the ownership of your Afaria domain Acquiring a Google enterprise token and whitelisting your Afaria domain After that, the information appears in the Afaria administration console on the Server Configuration Google Services page. After completing these two phases, Android for Work apps can be deployed on Android Lollipop devices. Procedure 1. Go to 2. Provide the required details in the Google form and create a Google account for your Afaria domain. Phone a valid mobile phone number. Business name the company's name. Business domain address the Afaria domain name. Username use the Afaria admin account user name. This will be the user name for your Google admin account as well. Setting up Android for Work (Afaria) 2016 SAP SE or an SAP affiliate company. All rights reserved. 5

6 Password a secure, strong password made up of more than 8 alphanumeric characters and symbols. This is the password for your Google admin account. Make a note of these credentials as you will need them later. 3. You will be redirected to the Android for Work setup page. If you are not redirected automatically, sign in to the Google account using the administrator address and password you just created. You may need to verify your credentials by providing the Google verification code sent to your mobile number. 4. Click Start to start the domain verification process. Google provides the following three methods for verifying domain ownership: Verify by adding a meta tag Add a domain host record (TXT or CNAME) Upload HTML file to your website Select one of these methods and follow the instructions in the Google portal to complete the domain verification. Perform the domain verification process only once during the initial Android for Work configuration. Once the domain is verified, Google generates an enterprise token. Save this token in a secure location. It is required to complete the configuration. Until you enroll the enterprise, the unused token appears in under Security Android for Settings for 30 days from the time you generate the token. If the token expires, use Generate Token in the same location to generate a new token. 5. Navigate to Server Configuration Google Services. 6. Log in to using the administrator credentials created during your initial registration of the Afaria domain. a. Go to Select a project Create a project and create a project to generate a service account. b. In the left pane of the Google console, navigate to Products & Services (hamburger icon) API Manager Overview. The right pane now displays the Google APIs. Select Admin SDK and click Enable API. c. Go back to Products & Services (hamburger icon) API Manager Overview. Search for Google Play EMM API using the search field. Enable the API. d. In the left pane, select Credentials. In the right pane, click Add credentials Service account key. e. Select New service account from the drop-down list. Enter a name for your service account. The Service account id is generated automatically. Choose P12 as the key type and click Create. If you do not see the option to select a new service account and provide a name, just choose P12 as the key type and click Create. Both the service account name and service account id are automatically generated. Google downloads a.p12 key file (Public-Key Cryptography Standards #12 format) to your local system. Copy or save the p12 passphrase from the popup window and click Close. f. Click Manage service accounts Options Edit. Select Enable Google Apps Domain-wide Delegation and click Configure consent screen. g. Update the OAuth consent screen and click Save SAP SE or an SAP affiliate company. All rights reserved. Setting up Android for Work (Afaria)

7 Table 1: Fields in OAuth Consent Screen Field Name Field Field Type address Select the Google admin account address Required Product name shown to users Provide SAP Mobile Secure Homepage URL Provide your homepage URL Optional Product logo URL Privacy policy URL Terms of service URL Provide your product logo URL Provide your privacy policy URL Provide your terms of service URL This information appears on the mobile device for Mobile Place users during the Android for Work setup (when the user installs an Android for Work app on the device for the first time). h. Click Save in the Edit service account window. i. Go back to Credentials Manage service accounts Options View client id. Copy and save the Client ID and service account address in a secure location. 7. Log in to using the Google administrator credentials created during your initial registration of the Afaria domain. a. Navigate to Security Advanced Settings Manage API client access. b. Paste the client ID from the earlier step into Client Name. c. Paste the admin.directory.user, and URLs into One or more API scopes. d. Click Authorize. 8. Go to the SAP support portal and create an incident to whitelist your Afaria domain for Android for Work. In the Component field, select MOB-AFA. In the field, indicate that this request is to enroll your Afaria domain for Android for Work. Also, provide the following account-specific details in the incident: Afaria domain name Enterprise token generated by Google Service account address Once the incident is received by SAP Support, the specified Afaria domain will be whitelisted and the status will be updated in the incident. 9. After the incident indicates that your Afaria domain is whitelisted, go to Server Configuration Google Services in the Afaria admin portal and enter the service account address, domain name, and p12 key passphrase. Upload the.p12 key file that is saved on your local system. 10. Click Save. The Enterprise Configured Bound status appears at the bottom of the page. Now that Android for Work is configured, Afaria administrators can create users within the Google directory on-demand, as users enroll their devices within Self Service Portal (SSP). The User name, First Name, and Last Name are the same in Google as they are in SSP. The address format is <username>@<domain name>.com. Each user is created with a random, strong password that is not saved anywhere. Setting up Android for Work (Afaria) 2016 SAP SE or an SAP affiliate company. All rights reserved. 7

8 You can now create and assign Android for Work application and configuration policies and link them to the devices group in order to start enrolling Android devices with Android for Work support. Ensure that you do not assign Android for Work policies and non Android for Work policies to the same device group. See Creating a Configuration Policy for Android for Work in the SAP Mobile Secure: Android for Work Quick Start Guide. All users are authenticated by Google as part of the enrollment process and before they can access Android for Work features. You may experience a delay of up to an hour for Android for Work support to be enabled for your account. If you experience a delay, wait a little while and try again. After you enroll the enterprise, the EMM provider's name appears in Security Android for Settings., under Once an enterprise token is used, it cannot be used again SAP SE or an SAP affiliate company. All rights reserved. Setting up Android for Work (Afaria)

9 4 Setting up Android for Work (Mobile Secure, New Setup) If you are setting up Android for Work for the first time, use Mobile Secure to register your Mobile Place domain with Google. You can start deploying Android Work Apps after completing the setup. Prerequisites We strongly recommend that you use a text editor, to copy and paste information from the Google website to Mobile Secure, as described in the steps below. The specific information to be copied consists of: Google account administrator credentials: Username (in the form of an address) Password Google verification code Google meta-tag value Google enterprise token Google Client ID Google service account address p12 key password Context Setup consists of: Verifying the ownership of the Mobile Place domain Acquiring a Google enterprise token and enrolling the enterprise After that, the information appears in the Afaria administration console on the Server Configuration Google Services page. After completing these two phases, users can enroll their Android Lollipop devices with Android for Work support through Mobile Place. Procedure 1. Log in to SAP Mobile Secure, go to Device Settings and select the Android for Work Settings tab. 2. On the Create a Google account page, click enterprise_product=android_work. Setting up Android for Work (Mobile Secure, New Setup) 2016 SAP SE or an SAP affiliate company. All rights reserved. 9

10 3. Provide the required details in the Google form and create a Google account for your Mobile Place domain. Phone a valid mobile phone number. Business name the company's name. Business domain address use the domain name provided in the Android for Work Settings tab. Username use the Mobile Secure admin account user name. This will be the user name for your Google admin account as well. Password a secure, strong password made up of more than 8 alphanumeric characters and symbols. This is the password for your Google account administrator credentials. Make a note of these credentials as you will need them later. 4. Sign in to the Google account using the administrator address and password you just created. You may need to verify your credentials by providing the Google verification code sent to your mobile number. 5. Click Start to start the domain verification process. 6. Copy the complete meta-tag value, that is, <meta name="google-site-verification" content="[ ]" />, from the Google portal to the Meta Tag text box in the Android for Work Settings tab in the Mobile Secure portal. Click Save Meta Tag. The meta-tag is added to your home page for Google to verify that you are the domain owner. After obtaining the meta-tag value, if you choose to complete the remaining configuration later, note down the meta-tag value as you will need it to complete the configuration. 7. Return to the Google portal, select I have added the meta tag to my homepage. and proceed with the verification. Google verifies that the meta-tag information has been added to your domain home page. Perform the domain verification process only once during the initial Android for Work configuration. After that, on subsequent logins to the Mobile Secure portal, the Android for Work Settings tab redirects you to the Enroll Enterprise page. Once the domain is verified, Google generates a token. Copy this token to the Enterprise Token text box on the Android for Work Settings Enroll Enterprise page. Until you enroll the enterprise, the unused token appears in under Security Android for Settings for 30 days from the time you generate the token. If the token expires, use Generate Token in the same location to generate a new token. 8. To enable single sign-on for simplified authentication for users, navigate to Device Settings Android for Work Settings Enroll Enterprise. Status: Configuration Incomplete appears at the top of the screen. 9. Log in to using the administrator credentials created during your initial registration of the Mobile Place domain. a. Go to Select a project Create a project and create a project to generate a service account. b. In the left pane of the Google console, navigate to Products & Services (hamburger icon) API Manager Overview. The right pane now displays the Google APIs. Select Admin SDK and click Enable API. c. Go back to Products & Services (hamburger icon) API Manager Overview. Search for Google Play EMM API using the search field. Enable the API. d. In the left pane, select Credentials. In the right pane, click Add credentials Service account key. e. Select New service account from the drop-down list. Enter a name for your service account. The Service account id is generated automatically. Choose P12 as the key type and click Create SAP SE or an SAP affiliate company. All rights reserved. Setting up Android for Work (Mobile Secure, New Setup)

11 If you do not see the option to select a new service account and provide a name, just choose P12 as the key type and click Create. Both the service account name and service account id are automatically generated. Google downloads a.p12 key file (Public-Key Cryptography Standards #12 format) to your local system. Copy or save the p12 passphrase from the popup window and click Close. f. Click Manage service accounts Options Edit. Select Enable Google Apps Domain-wide Delegation and click Configure consent screen. g. Update the OAuth consent screen and click Save. Table 2: Fields in OAuth Consent Screen Field Name Field Field Type address Select the Google admin account address Required Product name shown to users Provide SAP Mobile Secure Homepage URL Provide your homepage URL Optional Product logo URL Privacy policy URL Terms of service URL Provide your product logo URL Provide your privacy policy URL Provide your terms of service URL This information appears on the mobile device for Mobile Place users during the Android for Work setup (when the user installs an Android for Work app on the device for the first time). h. Click Save in the Edit service account window. i. Go back to Credentials Manage service accounts Options View client id. Copy and save the Client ID and service account address in a secure location. 10. Log in to using the administrator credentials created during your initial registration of the Mobile Place domain. a. Navigate to Security Advanced Settings Manage API client access (If Advanced Settings is not seen, click on Show More). b. Paste the Client ID from the earlier step in Client Name. c. Paste the admin.directory.user, and URLs into One or more API scopes. d. Click Authorize. 11. In the Mobile Secure portal, navigate to Device Settings Android for Work( Settings Enroll Enterprise and enter the following: Service account address Administrator address (Created during the initial registration of your Mobile Place domain. You can retrieve it by going to and clicking on your profile on the top right corner of the page. p12 key password Upload the.p12 key file that is saved on your local system. Setting up Android for Work (Mobile Secure, New Setup) 2016 SAP SE or an SAP affiliate company. All rights reserved. 11

12 12. Select I understand that the Mobile Place APIs will use my credentials below to create users in my Google Directory with the same username, First Name and Last Name as in Mobile Place in order to enable Single- Sign-On. 13. Click Enroll. Status: Configuration Completed appears at the top of the screen. Now that you have enrolled the enterprise and enabled single sign-on with Google, Mobile Secure administrators can create users within the Google directory on-demand, as users enroll their devices within Mobile Place. The User name, First Name, and Last Name are the same in Google as they are in Mobile Secure. The address format is <username>@<account>.sapmobileplace.com. Each user is created with a random, strong password that is not saved anywhere. You can now create Android for Work configuration policies and link them to the All Devices group in order to start enrolling Android devices with Android for Work support (at <account>.sapmobileplace.com/). See Creating a Configuration Policy for Android for Work on page 8 for further instructions. All users are authenticated by Google as part of the enrollment process and before they can access Android for Work features. You may experience a delay of up to an hour for Android for Work support to be enabled for your account. If you experience a delay, wait a little while and try again. After you enroll the enterprise, the EMM provider's name appears in Security Android for Settings., under Once an enterprise token is used, it cannot be used again. To generate a new token, first unenroll your domain from the Google account using the Unenroll button in the Android for Work Settings tab in the Mobile Secure portal SAP SE or an SAP affiliate company. All rights reserved. Setting up Android for Work (Mobile Secure, New Setup)

13 5 Configuring Android for Work (Mobile Secure, Existing Setup) Only to be used if you have enrolled with a previous version of the product and, on subsequent logins to the Mobile Secure portal, the Android for Work Settings tab redirects you to the Enroll Enterprise page. You then need to unenroll and enroll again to comply with Google s revised approach to Android for Work setup. Context You have already completed your domain verification with Google, which you need to do only once during configuration. On subsequent logins to the Mobile Secure portal, the Android for Work Settings tab redirects you to the Enroll Enterprise page. Here, to comply with Google s new approach for configuring the Android for Work setup, you must first unenroll, then reenroll. Procedure 1. Log in to SAP Mobile Secure, then go to Device Settings Android for Work Settings. 2. Click Unenroll. 3. Log in to using the administrator credentials created during your initial registration of the Mobile Place domain. If you have the client ID, p12 key, p12 key password, and service account address from your initial setup, you can use the same credentials. a. Select the existing project created during the initial Android for Work setup. b. Go to Products & Services (hamburger icon) API Manager Overview. Search for Google Play EMM API using the search field. Enable the API. c. In the left pane, select Credentials. In the right pane, click Add credentials Service account key. d. Select New service account from the drop-down list. Enter a name for your service account. The Service account id is generated automatically. Choose P12 as the key type and click Create. If you do not see the option to select a new service account and provide a name, just choose P12 as the key type and click Create. Both the service account name and service account id are automatically generated. Google downloads a.p12 key file (Public-Key Cryptography Standards #12 format) to your local system. Copy or save the p12 passphrase from the popup window and click Close. Configuring Android for Work (Mobile Secure, Existing Setup) 2016 SAP SE or an SAP affiliate company. All rights reserved. 13

14 e. Click Manage service accounts Options Edit. Select Enable Google Apps Domain-wide Delegation and click Configure consent screen. f. Update the OAuth consent screen and click Save. Table 3: Fields in OAuth Consent Screen Field Name Field Field Type address Select the Google admin account address Required Product name shown to users Provide SAP Mobile Secure Homepage URL Provide your homepage URL Optional Product logo URL Privacy policy URL Terms of service URL Provide your product logo URL Provide your privacy policy URL Provide your terms of service URL This information appears on the mobile device for Mobile Place users during the Android for Work setup (when the user installs an Android for Work app on the device for the first time). g. Click Save in the Edit service account window. h. Go back to Credentials Manage service accounts Options View client id. Copy and save the Client ID and service account address in a secure location. 4. Log in to using the administrator credentials created during your initial registration of the Mobile Place domain. a. Navigate to Security Advanced Settings Manage API client access (If Advanced Settings is not seen, click on Show More). b. Paste the Client ID from the earlier step in Client Name. c. Paste the admin.directory.user, and URLs in One or more API scopes. d. Click Authorize. 5. In the Mobile Secure portal, navigate to Device Settings Android for Work( Settings Enroll Enterprise and enter the following: Service account address Administrator address (Created during the initial registration of your Mobile Place domain. You can retrieve it by going to and clicking on your profile on the top right corner of the page. p12 key password Upload the.p12 key file that is saved on your local system. 6. Select I understand that the Mobile Place APIs will use my credentials below to create users in my Google Directory with the same username, First Name and Last Name as in Mobile Place in order to enable Single- Sign-On. 7. Click Enroll. Status: Configuration Completed appears at the top of the screen SAP SE or an SAP affiliate company. All rights reserved. Configuring Android for Work (Mobile Secure, Existing Setup)

15 You can now enroll Android Lollipop devices with Android for Work support at <account>.sapmobileplace.com/. All users are authenticated by Google as part of the enrollment process and before they can access the Android for Work features. You may experience a delay of up to an hour for Android for Work support to be enabled for your account. If you experience a delay, wait a little while and try again. After you enroll the enterprise, the EMM provider's name appears in Security Android for Settings., under Once an enterprise token is used, it cannot be used again. To generate a new token, first unenroll your domain from the Google account using the Unenroll button in the Android for Work Settings tab in the Mobile Secure portal. Configuring Android for Work (Mobile Secure, Existing Setup) 2016 SAP SE or an SAP affiliate company. All rights reserved. 15

16 6 Creating a Configuration Policy for Android for Work Create a configuration policy for scheduling device connections, collecting inventory, and configuring device and application settings for Android for Work devices. Context The policy includes multiple pages, such as Summary and Schedule and device-specific policy settings, which should be completed in order. To save changes on all pages, click Save at the top of any page. Configuration settings on the Android tab ( Policy Edit Android Configuration Summary Android ) have no effect on Android devices configured to use Android for Work policies. Procedure 1. On the Policy page, on the top toolbar, click New Configuration Android Android for Work. 2. On the Summary page, enter the policy name. You can specify duplicate policy names across tenants and within a tenant for all policy types. Changes made to support duplicate policy names are compatible with Afaria 6.6 and 7 servers. 3. Enter or select the remaining properties. add a description for the policy. State set to published or unpublished. Connecting devices receive only published policies. Priority set a user-defined value to determine which configuration policy prevails when multiple policies define the same default settings. The lower the numeric value, the higher the priority. Authentication validate the user identity against your authentication authority before allowing the policy to run. This option is available only if you have authentication enabled on the server, as defined on the Server Configuration Security page. Inventory select the inventory type to collect. You can view inventory information on the Device page's Device Inspector. Do not collect inventory no inventory collection. Hardware only scan collects data relating to the device's physical components, such as processors and memory cards. Software and Hardware scan collects hardware data and data for installed software. 4. (Optional) To configure a daily connection, define Schedule page properties SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

17 5. (Optional) Configure policy pages according to your requirements. 6.1 Google Chrome Page Configure settings for Google Chrome installed as part of Android for Work. Setting Enable Google Chrome Incognito Mode Availability Allows you to set Google Chrome settings for the configuration policy. Select Enable Google Chrome to make the settings on this page available. Available, Disabled, Forced. Incognito mode allows users to open incognito tabs in their browser session. In incognito tabs, cookies are disabled and no browser history is maintained. You can choose to enable incognito mode (Available), disable it (Disabled), or force all tabs to be opened in incognito mode (Forced). Save browser history Disable, Enable. Controls whether the browser saves the user's browsing history. Password Manager Not Enforced, Enabled, Disabled If you enable Password Manager, Google Chrome memorizes user passwords for future website logins. If you disable Password Manager, users cannot save passwords, nor use previously saved passwords. You can allow the user to configure the option, or you can specify that it is always on or always off. Autofill Not Enforced, Disabled Specifies whether the user can use the autofill feature to complete online forms. The first time a user fills out a form, Google Chrome automatically saves the entered information, such as the name, address, phone number, or address, as an autofill entry. You can allow the user to configure the option, or you can specify that it is disabled. Edit bookmarks allowed Yes, No Bookmark editing allows users to add, edit, or remove items from their Google Chrome bookmarks bar. Alternate error page Not Enforced, Enabled, Disabled Controls whether Google Chrome suggests alternate pages to the user when the page they are trying to reach is unavailable. The user sees suggestions to navigate to other parts of the website or to search for the page with Google. This setting corresponds to the Use a web service to help resolve navigation errors Google Chrome setting. You can allow the user to configure the option, or you can specify that it is always on or always off. Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 17

18 Setting Prerender Webpages Not Enforced, Enabled, Disabled Prerendering webpages can speed up the user's browsing experience by allowing Google Chrome to preload and render linked pages. This setting corresponds to the user setting Network action predictions on the Privacy section of the Advanced settings tab. You can allow the user to configure the option, or you can specify that it is always on or always off. Default search provider Not Enforced, Disabled This setting specifies whether the user can set a default search provider for the omnibox (Google Chrome's address bar) or not. Force safe search Yes, No Selecting Yes forces your users' Google searches in Google Chrome to be done with SafeSearch turned on. Search Suggest Not Enforced, Enabled, Disabled When users enter information into the address bar, Google Chrome can use a prediction service to help complete the web addresses or search terms. You can allow the user to configure the option, or you can specify that it is always enabled or disabled. This setting corresponds to the Use a prediction service to help complete searches and URLs typed in the address bar setting in Google Chrome's Settings page. Safe Browsing Not Enforced, Enabled, Disabled Specifies whether or not Safe Browsing is turned on for users. Safe Browsing helps protect users from websites that may contain malware or phishing content. You can allow users to decide whether to use Safe Browsing, or specify that it is always on or always off. Google Translate Not Enforced, Enabled, Disabled Lets you specify whether Google Chrome uses Google Translate, which offers content translation for web pages in languages not specified in the Language settings on a user's Google Chrome device. You can set Google Chrome to let users set this option in their local Google Chrome Settings, always offer translation, or never offer translation. Data compression proxy Not Enforced, Enabled, Disabled Enabling this setting can reduce cellular data usage and speed up mobile web browsing by using proxy servers hosted at Google to optimize and compress website content. You can set Google Chrome to allow the user to decide whether to use the data compression proxy, enable the data compression proxy, or disable the data compression proxy SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

19 Proxy Settings Setting Proxy Mode Not Enforced, None, Auto-Detect, System, PAC Script, Manual Specifies how Google Chrome connects to the Internet. If you leave the setting as Not Enforced, the user can change the proxy configuration in their Chrome Settings. If you choose any of the other Proxy Mode options, the user can't change the configuration. The remaining options are: None Auto- Detect System PAC Manual Google Chrome always establishes a direct connection to the Internet without passing through a proxy server. A direct connection is also the default configuration for Chrome devices if you do not set a policy and the user doesn't change the configuration. Google Chrome determines which proxy server to connect to using the Web Proxy Autodiscovery Protocol (WPAD). TBD. Proxy Auto-detect. Always use the proxy auto-config (.pac) file specified in the Proxy PAC URL field. Sets the server specified in the Proxy Server field as the proxy server to handle requests from Google Chrome. If you select this option, you need to enter the URL of the proxy server in the Proxy Server URL field below. Format the Proxy Server URL as 'IP address:port', such as ' :3128'. Leave it empty for any other Proxy Mode setting. Proxy PAC URL Proxy Server Available if PAC Script is selected. Specify the URL of the.pac file to use for network connections. Available if Manual is selected. If there are any URLs that should bypass the proxy server that handles other user requests, enter them in the Proxy Bypass URLs list. You can set up multiple URLs. To define a Proxy bypass URL, click Add from the toolbar and set the following: Setting Include/Exclude URL Select Include to include the proxy bypass URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the proxy bypass server. Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 19

20 URL Blacklist and Whitelist Settings A blacklist prevents Chrome devices from accessing specific URLs. A whitelist explicitly allows Chrome devices to access specific URLs. You can enter up to 1000 URLs for each list. URLs take the following form: Each URL must consist of a valid hostname (such as google.com), an IP address, or an asterisk (*) in place of the host. The asterisk functions as a wildcard, representing all hostnames and IP addresses. URLs can also include: The URL scheme, which is http, https, or ftp, followed by ://. A valid port value from 1 to The path to the resource. Query parameters. To optionally disable subdomain matching, put an extra period before the host. You cannot use user:pass fields, such as Instead, enter When both blacklist and blacklist exception filters apply (with the same path length), the exception filter takes precedence. If an extra period precedes the host, the policy filters exact host matches only. The policy searches wildcards (*) last. Optional query parameters consist of a set of key-value and key-only tokens delimited by '&'. The key-value tokens are separated by '='. A query token can optionally end with a '*' to indicate prefix match. Token order is ignored during matching. For examples of valid whitelist and blacklist specifications, search for "Set Chrome policies for users" at support.google.com. To add a URL to the blacklist or whitelist, click Add from the appropriate toolbar and set the following: Setting Include/Exclude URL Select Include to include the proxy bypass URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site you want to allow or deny. Managed Bookmark Settings To add a bookmark, click Add from the toolbar and set the following: Setting Include/Exclude Select Include to add the bookmark to users' available bookmarks when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

21 Setting Name URL Enter a name for the bookmarked site. The URL of the site to bookmark. Geolocation Settings Sets whether websites are allowed to track users' physical locations. This setting corresponds to the Chrome settings under Privacy Content settings Location. Tracking physical locations can be set by the user (Not Enforced), allowed by default (Allow), the user can be asked each time a website requests the physical location (Ask), or denied by default (Block All). Cookie Settings The Default cookies setting option determines whether websites are allowed to store browsing information, such as user site preferences or profile information. This setting corresponds to the Chrome settings under Privacy Content settings Cookies. Whether to allow cookies can be set by the user (Not Enforced), allowed by default (Allow All), or denied by default (Block All). Cookie session only URLs options: Setting Include/Exclude URL Select Include to include the cookie session-only URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to allow or deny cookies. Cookie blocked URLs. Allows you to specify a list of URL patterns of sites that are not allowed to set cookies. If this policy is not set, what you specify under Default cookie settings will be the global default, or the user can set their own configuration. Cookie blocked URLs options: Setting Include/Exclude URL Select Include to include the cookie-blocked URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to block cookies. Cookie allowed URLs. Allows you to specify a list of URL patterns of sites that are allowed to set cookies. If this policy is not set, what you specify under Default cookie settings will be the global default, or the user can set their own configuration. Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 21

22 Cookie allowed URLs options: Setting Include/Exclude URL Select Include to include the cookie-allowed URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to allow cookies. Image Settings The Default images setting option determines whether websites are allowed to display images. This setting corresponds to the Chrome settings under Privacy Content settings Images. Whether to display images can be set by the user (Not Enforced), allowed by default (Allow All), or denied by default (Block All). Image blocked URLs. Allows you to specify a list of URL patterns of sites that are not allowed to set display images. If this policy is not set, the user can set their own configuration. Image blocked URLs options: Setting Include/Exclude URL Select Include to include the image-blocked URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to block images. Image allowed URLs. Allows you to specify a list of URL patterns of sites that are allowed to display images. If this policy is not set, the user can set their own configuration. Image allowed URLs options: Setting Include/Exclude URL Select Include to include the image-allowed URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to allow images. JavaScript Settings The Default javascript setting option determines whether websites are allowed to run JavaScript. If you disable JavaScript, some sites may not work properly. Sets whether websites are allowed to run JavaScript. This setting corresponds to the Chrome settings under Privacy Content settings JavaScript. Whether to allow JavaScript can be set by the user (Not Enforced), allowed by default (Allow All), or denied by default (Block All) SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

23 Javascript blocked URLs options: Setting Include/Exclude URL Select Include to include the JavaScript-blocked URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to block JavaScript. Javascript allowed URLs options: Setting Include/Exclude URL Select Include to include the JavaScript-allowed URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to allow JavaScript. Popup Settings The Default popup setting option determines whether websites are allowed to display pop-ups. This setting corresponds to the Chrome settings under Privacy Content settings Pop-ups. Whether to allow pop-ups can be set by the user (Not Enforced), allowed by default (Allow All), or denied by default (Block All). Popup blocked URLs options: Setting Include/Exclude URL Select Include to include the pop-up-blocked URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to block pop-ups. Popup allowed URLs options: Setting Include/Exclude URL Select Include to include the pop-up-allowed URL when the policy is run. If you select Exclude, the URL remains on the list but is not deployed to the device. The URL of the site for which you want to allow pop-ups. Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 23

24 6.2 Exchange Account Policy Page For a user that is already defined in the Microsoft Exchange environment, sets properties for the native Microsoft Exchange ActiveSync (EAS) client. You can use substitution variables for most of the values defined on this page. See Substitution Variables for more information. Setting Enable Exchange Account Username Password Domain Allows you to set Exchange Account settings for the configuration policy. Enable to make the settings on this page available. User's Exchange user name User's Exchange password User's domain for the Exchange account This is not a required field. The domain must be specified in either the Username field ("user@domain" or "domain\user") or the Domain field. If specified in the Domain field, Afaria appends it to the username. If it is specified in both places and the domain is different, Afaria use the one in the username field. Address Exchange host Require SSL Trust All Certificates User Certificate User's Exchange address Fully qualified domain name for the Microsoft Exchange server Select Yes to require the use of SSL for Exchange sessions. Select Yes to allow the device to accept certificates without user intervention. To add the client certificate, click Add Certificate, browse to select a certificate, and then specify a password for the certificate. To add a SCEP request, click Add request, select a CA profile from the drop-down list, and specify the common name and password for the CA. You may also specify an alt name for the certificate. Signature Maximum attachment size (MB) Enable tasks application Signature for user-initiated messages. If left blank, the user can enter a signature. The maximum size of attachments in megabytes. Select Yes to enable the Exchange Tasks application on the device SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

25 6.3 Restrictions Page For Android for Work devices, defines restrictions for user access to certain features. Setting Enable Restrictions Screen Capture Enable Camera Contact Sharing Copy and paste Notification Allows you to set restrictions for the configuration policy. Enable to make the settings on this page available. Allows you to enable or disable screen captures on the device. Allows you to enable or disable the camera on the device. Only applies to Android 5.0 and later devices. Allows you to allow or prevent the user from sharing contacts on the device. Only applies to Android 4.4 and earlier devices. Allows you to allow or prevent the user from copying and pasting data on the device. Only applies to Android 4.4 and earlier devices. Allows you to determine how notifications are displayed on the lock screen. You can allow the device to display the full notification or instead display a notification with the content hidden. Only applies to Android 4.4 and earlier devices. IME Whitelist Allows you to create a list of approved keyboard and input methods. Only keyboard and input methods defined in the list will be available to the user. Only applies to Android 4.4 and earlier devices. To add a keyboard and input method to the list, click Add from the toolbar and set the following: Setting Include/Exclude Name Select Include to include the keyboard and input method when the policy is run. If you select Exclude, the method remains on the list but is not deployed to the device. The name of the keyboard and input method. For example, "English (US) Google Keyboard". Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 25

26 6.4 Security Page Configure password settings and provide certificates for the Android for Work profile on Android devices. Setting Enable Password Password Quality Minimum password length Invalid password attempts before Android for Work data wipe Maximum idle time until lock Password History Maximum number of days until password expires Allows you to set password settings for the configuration policy. Enable to make the password settings on this page available. The password format required, either Something, Numeric, Alphabetic, Alphanumeric, or Complex. The minimum length for the password. The range is 4 16 characters. The number of times a user can enter a wrong password before data wipe occurs. The maximum time that the user can configure the device to remain idle before the device screen locks. The options are: 15 sec, 30 sec, 1 min, 2 min, 5 min, 10 min, and 30 min. The number of passwords stored in the history list. The range is The default is 10. The number of days a password remains valid. The range is means there is no restriction (the password does not expire). The default is 90 days. This setting is currently not enforced by Google. Minimum password letters The minimum number of letters in the password. The range is Complex password format only Minimum password lowercase Complex password format only Minimum password uppercase Complex password format only Minimum password non-letter Complex password format only Minimum password numeric The minimum number of lowercase letters in the password. The range is The minimum number of uppercase letters in the password. The range is The minimum number of non-letter characters in the password. The range is The minimum number of numbers in the password. The range is Complex password format only Minimum password complex characters The minimum number of symbols in the password. The range is SAP SE or an SAP affiliate company. All rights reserved. Creating a Configuration Policy for Android for Work

27 Setting Complex password format only Certificates Configure settings for CA certificates used to authenticate connections between the Android for Work profile and your network. To add a certificate, click Add from the toolbar and set the following: Setting Include/Exclude Certificate Select Include to include the certificate when the policy is run. If you select Exclude, the certificate remains on the list but is not deployed to the device. To add the client certificate, click Add Certificate, browse to select a certificate, and then specify a password for the certificate. To add a SCEP request, click Add request, select a CA profile from the drop-down list, and specify the common name and password for the CA. You may also specify an alt name for the certificate. In order to install a SCEP certificate on a device, the device must have a password. If you include a SCEP request in this policy, ensure you configure password settings on this page. 6.5 WiFi Page Configure WiFi connections on Android for Work devices to allow users to connect wirelessly to your network. You can also choose to block users from connecting to a configured network connection. To remove a network configuration from the Android Client, include the item you wish to delete and delete the Network SSID. The item with that Identifier will then be deleted when the Client runs this policy. Setting Enable Wifi Include/Exclude Allows you to set WiFi settings for the configuration policy. Enable to make the settings on this page available. Allows you to include or exclude the connection profile from the configuration policy. Creating a Configuration Policy for Android for Work 2016 SAP SE or an SAP affiliate company. All rights reserved. 27