PUBLIC SAP HANA Cloud Platform, mobile service for security Administration Guide

Transcription

1 SAP HANA Cloud Platform, mobile service for security Document Version: PUBLIC SAP HANA Cloud Platform, mobile service for security Administration Guide

2 Content 1 Overview SAP HANA Cloud Platform, mobile service for security Logging onto the Mobile Service for Security Account Management Updating Mobile Place Settings Configuring Single Sign-On (SSO) for Mobile Place Customizing Mobile Place Customizing Mobile Secure User Management Managing Users Configuring View Settings Exporting Lists of Users Adding Fiori Front-end Server Connections Group Management Creating Static Groups Creating Directory Groups Managing My Profile Generating API Credentials Signing Profiles Creating a Signing Profile Editing a Signing Profile Deleting a Signing Profile Device Test Cloud Service Configuring the Device Test Cloud Service Using the Device Test Cloud Service Application Management Mobile Place Versus MDM Client to Distribute Applications Adding an Enterprise Application Adding a Web Application Adding an ios or Windows Application from a Commercial App Store Adding an Android Application from a Commercial App Store Adding an OS X Configuration Payload Adding a New Application Category Approving or Rejecting Apps SAP SE or an SAP affiliate company. All rights reserved. Content

3 5.9 Wrapping Applications Updating an Enterprise Application Configuration Discovery Service Using the Configuration Discovery Service Device Management Viewing Dashboard Administering Devices Adding Substitution Variables to Enrollment Policies Managing Device Settings Auto-Discovery Support for Windows Phone Enrollment Creating and Configuring the Auto-Discovery Server Android for Work Configuring Android for Work (Mobile Service for Security, Existing Setup) Setting up Android for Work (Mobile Service for Security, New Setup) Analytics Content 2016 SAP SE or an SAP affiliate company. All rights reserved. 3

4 1 Overview SAP HANA Cloud Platform, mobile service for security allows you to secure mobile devices, mobile apps, and mobile content. Mobile device management SAP HANA Cloud Platform, mobile service for security is the trusted solution for managing and securing mobile device deployments in companies of any size. Mobile device management quickly self-enroll devices for enterprise use; preconfigure settings to enforce security and compliance policies. Highly secure and scalable remotely lock and wipe managed devices, and control security settings for bring-your-own-device (BYOD) or corporate-owned devices. Robust analytics gain instant insight into mobile device usage and the ability to take immediate action. Mobile application management manage and secure applications (enterprise or commercial app store) on your devices. Mobile Place is the end-user portal forsap HANA Cloud Platform, mobile service for security, combining the best features of mobile application management (MAM) and mobile device management (MDM), and providing a single interface into the enterprise mobility management (EMM) environment for both managed and unmanaged users and devices. Add, modify, and delete applications. Approve applications that can be consumed by users. App wrapping enables enterprises to quickly secure existing corporate and third-party applications without having to write any code. Mobile content management SAP Mobile Documents lets users enjoy anytime, anywhere access to view and collaborate on personal and corporate content, in an easy-to-use, native mobile app. For more information, refer to SAP Mobile Documents product documentation on SAP Help Portal SAP SE or an SAP affiliate company. All rights reserved. Overview

5 2 SAP HANA Cloud Platform, mobile service for security Either a trial user or an enterprise user can access thesap HANA Cloud Platform, mobile service for security portal. To explore the producton trial basis, go to the SAP HANA Cloud Platform Cockpit and click on Register. For more information, refer to the Getting Started Guide and other product documents that are available on help.hana.ondemand.com/help/frameset.htm. If you are an enterprise user, go to the SAP HANA Cloud Platform Cockpit and click Log On to log in and access the SAP HANA Cloud Platform, mobile service for security. SAP HANA Cloud Platform, mobile service for security 2016 SAP SE or an SAP affiliate company. All rights reserved. 5

6 3 Logging onto the Mobile Service for Security Manage all the devices and applications within your enterprise from the SAP HANA Cloud Platform, mobile service for security administrator portal. As an administrator, you can log in to the portal using the enterprise login credentials SAP SE or an SAP affiliate company. All rights reserved. Logging onto the Mobile Service for Security

7 4 Account Management Manage account information for the SAP HANA Cloud Platform, mobile service for security portal and Mobile Place. Navigation in the UI: Select Account Overview to view account information. Select Account Settings Mobile Secure to set a default language for the Mobile Secure portal. Select Account Settings Mobile Place to view and update Mobile Place settings, and to customize Mobile Place. See Mobile Place Branding Guide on SAP Help Portal for further information. Select Account Customization Mobile Secure to upload customized and localized content. Select Account Customization Mobile Place to customize Mobile Place. See Mobile Place Branding Guide on SAP Help Portal for further information Select Account Device Setup Apple MDM Certificate to set up the APNS.See Creating an APNS Certificate on SAP Help Portal for further information Select Account Device Setup Enterprise ios Client to deploy an enterprise ios client. Select Account Device Setup Windows Phone Discovery Server to configure the discovery service. Select Account Device Setup Android for Work to configure the AfW service. Select Account Fiori Mobile Connection Management to configure Fiori Front-end server. Select Account Signing Profile to manage signing profiles for Android and ios apps. Select Account Device Test Cloud test ios and Android apps on actual mobile device. Select Account App Protection Cloud to enable third party app protection. Select Account Health Dashboard for health diagnostics. 4.1 Updating Mobile Place Settings You can update the device and connections settings that users can view and select when they access Mobile Place. Procedure 1. Click Account Settings Mobile Place. 2. Set the default mode for Mobile Place users to either Managed or Unmanaged. This setting appears as the default mode in the Add User dialog. Unmanaged users can only use Mobile Place to install enterprise apps, that is, they cannot enroll devices. Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 7

8 3. Select the default display language for Mobile Place. Mobile Place supports Čeština (cs), Deutsch (de), English (US) (en-us), Español (es), Español (Latinoamérica) (es-419), Français (fr), Français (Canada) (fr-ca), Magyar (hu), Italiano (it), 日 本 語 (ja), 한국 어 (ko), Polski (pl), Português (Brasil) (pt-br), Română (ro), Русский (ru), ภาษาไทย (th), Türkçe (tr), 中 文 ( 简 体 ) (zh-cn) and 中 文 ( 繁 體 ) (zh-tw). To add a new language, click Edit localization resources. See Customizing Mobile Place. All the languages are disabled except English. You can enable other languages using the Customization tab. During activation or first-time login, Mobile Place uses the browser language that is set on the device. If the browser language is not supported by Mobile Place, then the Mobile Place default display language is used. 4. Enable Allow browsing of App / Service catalog to managed devices prior to enrollment to allow managed Mobile Place users to access the App Catalog without enrolling the device. 5. Enable Allow browsing of App / Service catalog without requiring authentication (operates in unmanaged mode) to allow Mobile Place users to access the App Catalog without authentication. If this option is enabled, only applications intended for unauthenticated users are visible in the App Catalog. If an Account Admin has enabled this option, then Mobile Place end users can access the App Catalog without authentication. By default, they will be directed to the Mobile Place App Catalog and users can access applications meant for unauthenticated users. For an unauthenticated user, features such as My Trials, My Web Apps, My Devices, and Settings are not available in the App Catalog. If a user has an account and wants to login, user must select the Login menu item from the hamburger menu. Once the user logs in, this user will now be presented with an updated App Catalog that displays applications and services meant for authenticated users. 6. Under the End User License Agreement (EULA) section, select whether the EULA prompt has to be displayed during initial logon to managed users, unmanaged users, unauthenticated access of mobile place, or each time the EULA changes. To add or edit an EULA resource file, click Edit EULA resources. See Customizing Mobile Place. 7. Click Update Settings. 4.2 Configuring Single Sign-On (SSO) for Mobile Place Configure SAP HANA Cloud Platform, mobile service for security to allow your Mobile Place users to use single sign-on (SSO) to log in to Mobile Place. SAP HCP, mobile service for security supports SSO using SAML 2.0. Context To configure SSO for SAP HCP, mobile service for security users, see HTTP Destinations in SAP HANA Cloud Documentation SAP SE or an SAP affiliate company. All rights reserved. Account Management

9 4.3 Customizing Mobile Place You can update or add new settings to customize Mobile Place. Procedure 1. Select Account Customization Mobile Place, then select Upload New Resource. 2. Select one of the following resource types: Style sheet Public localization properties file Private localization properties file EULA (unmanaged) EULA (unmanaged) must be UTF-8 encoded. EULA (managed) EULA (managed) must be UTF-8 encoded. EULA (managed and unmanaged) EULA (managed and unmanaged) must be UTF-8 encoded. EULA (unauthenticated access) EULA (unauthenticated access) must be UTF-8 encoded. Logo image Background image Shortcut icon Webclip image Support content Support page must be UTF-8 encoded. Default app icon 3. Enter a valid name for the customization resource file. Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 9

10 4. Select a language. By default, languages that are supported are Čeština (cs), Deutsch (de), English (US) (en-us), Español (es), Español (Latinoamérica) (es-419), Français (fr), Français (Canada) (fr-ca), Magyar (hu), Italiano (it), 日 本 語 (ja), 한국어 (ko), Polski (pl), Português (Brasil) (pt-br), Română (ro), Русский (ru), ภาษาไทย (th), Türkçe (tr), 中 文 ( 简 体 ) (zh-cn) and 中 文 ( 繁 體 ) (zh-tw). 5. Click Browse to upload a resource file. 6. Enter a resource description. 7. Click Upload. The resource file appears on the Customization tab. 8. Select one of the following action items by selecting the icon that appears in the Action column: Download - Download the resource file. Preview - Preview the resource file. Enable - Enable the resource file for the customization setting to take effect on Mobile Place. Disable - Disable the resource file to remove the customization setting from Mobile Place. Delete - Delete the resource file from Mobile Secure Admin Portal. 4.4 Customizing Mobile Secure You must upload customized and localized content for s on Mobile Secure, in order for users to receive s in their preferred languages. By default, s are sent in the default language set by you. Procedure 1. Select Account Customization Upload New Resource. 2. Select the customized resource file for the desired language and click Upload. Your uploaded resource file appears in the Localization Properties file section. 3. Select corresponding to the desired resource file, and then select Enable. 4.5 User Management Modify user details such as user type, assigning user to groups and notify users SAP SE or an SAP affiliate company. All rights reserved. Account Management

11 4.5.1 Managing Users Use the HCP cockpit to manage users and their roles. You can add and remove users for an account and select and deselect roles. All members assigned to the selected account can use the functionality provided by SAP HANA Cloud Platform in the scope of this account and as permitted by their assigned account member roles. These roles support typical tasks performed by users when interacting with the platform. For more information on adding and managing users, See Managing Members in SAP HANA Cloud Documentation Configuring View Settings You can configure user information view settings by sorting or filtering based on various parameters. Procedure 1. Click Users Manage Users. 2. Select Filters to filter the user information based on: First Name Last Name User Name Roles 3. Click GO to filter user information. 4. (Optional) To clear all the filter information, select Filters then select Clear. Select Show Filter Bar to display the filters. (Optional) To hide all the filter information, select Hide Filter Bar Exporting Lists of Users Export the list of users to an Excel spreadsheet (.csv format) to share or analyze the information. Context The exported Excel spreadsheet contains the following information about the users: First Name Last Name Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 11

12 User Name Phone Type Enterprise Authenticated Activated Activation Date Account Admin App Catalog Admin App Catalog Publisher Device Admin Device Help Desk Device Help Desk Read Only Map Admin Mobile Place User Report User Procedure 1. Select Users > ManageUsers. 2. Optional: Filter the table information, as desired. 3. Select Export. The Excel spreadsheet is saved under the local system Downloads folder with the file name users_exports_q<yyyy-mm-dd>.csv, where <yyyy-mm-dd> is the date that the users were exported to the spreadsheet. 4.6 Adding Fiori Front-end Server Connections Add new Fiori Front-end server connection to mobilize the Fiori apps. For more information on how to add Fiori Front-end server connections, see Configuring the Fiori Server Connection in SAP HANA Cloud, mobile service for SAP Fiori User Guide. 4.7 Group Management Add, modify, or delete static and directory groups, and assign users and applications to groups. A group is used to associate a specific set of applications to a specific set of users. You can assign users to static groups; for directory groups, the users are assigned based on the Active Directory (AD) group selected SAP SE or an SAP affiliate company. All rights reserved. Account Management

13 4.7.1 Creating Static Groups Create a new static group, and assign users and applications to it. Procedure 1. Select Users Manage Groups. Click Filters to filter the groups based on: Group Type Group Name 2. Click New group, and select Static Groups. 3. In the Details page, provide a name and description for the group, and enter keywords to search for the group. Name cannot exceed 254 characters, including spaces. Description cannot exceed 4000 characters, including spaces. Keywords should be comma-separated, and cannot exceed 60 characters for one keyword. 4. In the Users page, select the users for the group. The list shows only users having Mobile Place User role and above. You can use the filter option to search for selected users, unselected users, or all users. You can also use the Actions icon to sort the user list based on names, or apply filter to search for a user. 5. In the Apps page, select the apps to associate with the group. You can select apps from the various app categories that are maintained. You can use the filter option to search for selected apps, unselected apps, or all apps.you can also use the Actions icon to sort the app list based on parameters like application name and type, or apply filter to search for an app. 6. Click Save to create a static group to which the selected users and applications are associated. A group created in the SAP HCP, mobile service for security Administration portal does not appear in the Afaria Administration console Creating Directory Groups Create a directory group(active directory or LDAP), and assign groups from the enterprise Active Directory (AD) Organization Unit (OU) lists. Prerequisites You can create directory groups only if you have configured the Enterprise Connector (with AD). Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 13

14 Procedure 1. Select Users Groups. Select Filters to filter the groups based on: Group Type Group Name 2. Click New group, and select Directory Groups. 3. In the Details page, provide a name and description for the group, and enter keywords to search for the group. Name cannot exceed 254 characters, including spaces. Description cannot exceed 4000 characters, including spaces. Keywords should be comma-separated, and cannot exceed 60 characters for one keyword. 4. In the Directory page, click Open Directory. 5. In the list of available directory groups, search for the required AD group, and use the arrow key to select it. 6. In the Apps page, select the apps from various categories to be associated with the group. You can use the filter option to search for selected apps, unselected apps, or all apps. You can also use the Actions icon to sort the app list based on parameters like application name and type, or apply filter to search for an app. 7. Click Save to create a directory group to which the selected users and applications are associated. The directory groups feature is not available for trial accounts. 4.8 Managing My Profile You can use My Profile to view user details, such as first name, last name, address, phone number, and current password. You can also generate an API password to access SAP Mobile Secure Product API services. Context Go to > My Profile to generate an API password, see: To edit user details or change password, see Managing Members in SAP HANA Cloud Documentation SAP SE or an SAP affiliate company. All rights reserved. Account Management

15 4.8.1 Generating API Credentials You can generate an API password to accesssap HCP, mobile service for security Product API services. Procedure 1. In the API Credentials table, click Generate Password. 2. In API credentials generated pop-up, choose Download. The API credential is available in a.csv file format and is valid for 182 days. 3. Save a local copy of this file for future reference. 4. (Optional) Choose Regenerate to generate a new password. You can regenerate a new password if: The current password has expired. You have exceeded the maximum incorrect attempts allowed. You cannot access the Product API using the existing credential. 5. (Optional) Choose Delete to delete the password. 6. Click Save. 4.9 Signing Profiles An account administrator can create signing profiles for an account and make them available for app publishers to use while creating Android and ios applications. Signing profiles can also be edited or deleted Creating a Signing Profile Create a new signing profile for Android or ios. Procedure 1. Select Account Signing Profile. 2. Click New Profile. 3. Select Android or ios and click OK. Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 15

16 4. Provide the following information on the Details page. For Android platform: Name KeyStore File (in.keystore or.jks format) KeyStore Password KeyChain Alias For ios platform: Name Signing Certificate (in.p12 format) Private Key Pass-phrase Provisioning Profile (in.mobileprovisioning format) Select I have made SAP a Team Member in my Enterprise Apple Developer Program* For ios, to install multiple apps on a single device, the administrator must use a different provisioning profile for each device 5. Click Save Editing a Signing Profile Edit an existing signing profile for Android or ios. Procedure 1. Select Account Signing Profile. 2. Select the profile you want to edit and make the required changes. You cannot change the name of the signing profile. 3. Click Save Deleting a Signing Profile Delete a signing profile for Android or ios. Prerequisites Ensure that the apps that are using the signing profile you are about to delete are not undergoing a build or present in the app build queue SAP SE or an SAP affiliate company. All rights reserved. Account Management

17 Procedure 1. Select Account Signing Profile. 2. Select the profile you want to delete. 3. Click Delete. 4. Click OK Device Test Cloud Service Test ios and Android apps on actual mobile devices made available by Device Test Cloud service providers. Using this feature, you can launch and test ios and Android apps uploaded to the SAP HCP, mobile service for security App Catalog. The following app types are supported for testing: Enterprise apps Web apps Fiori mobile apps Using the Device Test Cloud service you can: Enable Device Test Cloud features by selecting the default provider (Keynote Mobile Testing) or by configuring a custom device test cloud service provider. Currently Keynote Mobile Testing is the sole publicly available provider supporting integration with SAP HCP, mobile service for security. Configuring a custom installation as a Device Test Cloud service is considered to be a custom provider configuration. For information on the base URL to use for custom installations, please inquire with your service provider. From the SAP HCP, mobile service for security Applications page, select the app to be tested and launch it using the configured Device Test Cloud service Configuring the Device Test Cloud Service Use the Device Test Cloud service to test ios and Android apps on actual mobile devices made available by Device Test Cloud service providers. Procedure 1. Select Account Device Test Cloud. The Device Test Cloud page is displayed. Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 17

18 2. Select your service from the Test cloud provider drop-down. Your options are: Keynote Mobile Testing The default setting. Custom None Use to configure a custom device test cloud service with an alternate service provider. Use to disable access to the Device Test Cloud service. 3. If you select Keynote Mobile Testing, the remaining fields on the page are automatically filled in with the required information to use the Keynote Mobile Testing service. If you select Custom you will need to determine and provide the following information for your Device Test Cloud service: Base URL Name Redirect URL Logo Homepage Privacy URL Terms of Use URL The URL to be used to connect to your Device Test Cloud service. A display name for the Device Test Cloud service. This will appear on the information dialog displayed when you launch the Device Test Cloud Service for the app to be tested. The redirect URL used in the oauth2 protocol. An optional graphic to use for the Device Test Cloud service. This graphic will appear on the information dialog displayed when you launch the Device Test Cloud Service for the app to be tested. The home page of the Device Test Cloud service. This link will appear on the information dialog displayed when you launch the Device Test Cloud Service for the app to be tested. A link to the privacy policy page of the Device Test Cloud service. This link will appear on the information dialog displayed when you launch the Device Test Cloud Service for the app to be tested. A link to the terms of use page of the Device Test Cloud service. This link will appear on the information dialog displayed when you launch the Device Test Cloud Service for the app to be tested. 4. Click Save. The Device Test Cloud Service is configured. Proceed to Using the Device Test Cloud Service Using the Device Test Cloud Service Test your ios or Android apps using a configured Device Test Cloud service. Prerequisites Your Device Test Cloud service must be configured. See Configuring the Device Test Cloud Service SAP SE or an SAP affiliate company. All rights reserved. Account Management

19 The following instructions are for connecting to the Keynote Mobile Testing service. If you are using a custom configuration for a third-party service, you must determine and follow the required steps for that service. SAP is not responsible for issues encountered while using third-party service providers, including Keynote. Please use the support mechanisms provided by your service provider to resolve any issues you encounter with their service. We also recommend that you review the terms and conditions of use for any service provider. Procedure 1. Select the Applications page and click Manage Apps Apps home. 2. Click Actions Launch on Device Cloud. The Launch on Device Cloud menu item is only available if you have already configured the Device Cloud Test service. 3. Carefully review the Confirmation dialog. You can set the confirmation screen off by selecting the Do not prompt me again checkbox. You can re-enable the Confirmation dialog for subsequent sessions using the Skip warning when launching app in device test cloud checkbox on the My Profile page. 4. Click Continue. The Keynote Mobile Testing page is launched and a consent dialog is displayed, identifying all of the information that will be shared with the service. On the right side of the page are the links and logo graphic you set up as part of the configuration process. 5. Carefully review the information to be shared and click Approve. Your application is transferred to Keynote and you can then follow the instructions on that site to select devices and test your application. Account Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 19

20 5 Application Management Either a trial user or an enterprise user can access the SAP HANA Cloud Platform, mobile service for security portal. To explore the producton trial basis, go to the SAP HANA Cloud Platform Cockpit and click on Register. For more information, refer to the Getting Started Guide and other product documents that are available on help.hana.ondemand.com/help/frameset.htm. If you are an enterprise user, go to the SAP HANA Cloud Platform Cockpit and click Log On to log in and access the SAP HANA Cloud Platform, mobile service for security. 5.1 Mobile Place Versus MDM Client to Distribute Applications The MDM client and the Mobile Place application catalog can both perform application distribution. Applications that are ready for distribution might appear in either the MDM client, or in the Mobile Place application catalog, or both. Mobile Place includes a multichannel app store. This means that delivery can be done in MAM mode or MDM mode. If you are not leveraging the SAP HANA Cloud Platform, mobile service for security MDM features,you can use only Mobile Place to manage applications. The MDM client does not exist on the device and therefore cannot be used. Create application policies that need the Required flag to be enabled (effective on ios and Samsung SAFE/ KNOX) in the MDM console, and deploy them directly. 5.2 Adding an Enterprise Application An App Catalog Administrator or an App Catalog Publisher can add a enterprise application published on Mobile Place. Procedure 1. Click Applications. 2. From the Manage Apps tab, click New Application. 3. Select Enterprise Application and click Next. 4. Enter the following information in the Details page: SAP SE or an SAP affiliate company. All rights reserved. Application Management

21 Language - Select a language from the list. The languages that appear depend on the language settings on the Account Settings Mobile Place page. Name - Enter a name for the new application. The name cannot exceed 200 characters, including spaces. Description - Enter a description for the new application. The description cannot exceed 4000 characters, including spaces. HTML content is supported. You can also apply styles to the description text, such as different fonts, text color, background color and insert or unlink URLs. Select any text to enable the Insert/Edit Link control. In the Insert/Edit Link window. 1. Enter the link URL. 2. In the Target field, specify whether the link is opened in the current window or a new one. 3. Enter the title and click Insert. Applying styles on the text affects the number of characters. Minimize style effects to maximize the number of characters you can enter. (Optional) Keywords - Enter keywords separated by commas that help users search for, and retrieve, new applications. Keywords cannot exceed 60 characters. 5. (Optional) Select one or all of the following options: Deploy to managed devices only Mark as featured app Accessible to unauthenticated users By default, the check box Accessible to unauthenticated users is disabled. This checkbox is enabled only if unauthenticated access is enabled from Account Settings Mobile Place page. If Accessible to unauthenticated users check box is selected, an application is visible to unauthenticated users only. You can not select both the check boxes Deploy to managed devices only and Accessible to unauthenticated users at the same time. 6. Click Save to save the information on the Details page. 7. Click Groups, and select the visibility of the application to all users, or only to selected groups. You can search for an existing group by typing the group name in the search groups window. Use the Actions icon to sort the list based on group name, or apply filters to search for a group. You can also create a new group, if required, by selecting the static or directory group option from the New group drop-down list. The newly created group is selected, by default. For more information on how to create groups, see Group Management section. 8. If you have chosen to show the application only to selected groups, select the required groups from the list. 9. Click Multimedia. Upload an application icon or banner image by clicking Browse. The application icon must support the following properties: Application Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 21

22 Only png, jpeg, and jpg file formats are supported. The recommended resolution is 76px X 76px. You can upload only one application icon. If you do not upload an application icon, the default application icon (the image that appears below the Application icon field) is used. The banner image must support the following properties: Only png, jpeg, and jpg file formats are supported. The recommended resolution should be 1024px X 230px. You can upload only one banner image. 10. Click Save to save the information on the Multimedia page. 11. Click Categories. To add a new application to available categories, double-click or drag and drop categories from the Available box to the Selected box. 12. Click Save to save the information on the Categories page. 13. Click Owner info to view owner information of a application and select up to five co-owners for a new application. 14. Click the Edit App Owner icon to change the application owner. Only users with App Catalog Admin role can edit the application owner. The Select Owner dialog is displayed. Only users who have App Catalog Admin and App Publisher roles are displayed. 15. Click on the radio button to select the user and click OK. App owner information is updated in the Owner info page. 16. Click Add Co-Owner to add new co-owner(s). The Select co-owners dialog is displayed. 17. Search for a co-owner by username, first name, last name, or address. Only users who are assigned the App Catalog Admin role or App Publisher role can be selected as coowners. 18. Select the checkbox to select a co-owner. 19. Click OK. Selected co-owners now appear on the Owner info page. 20.Click Save to save the Owner info page. 21. Click Supported platforms to add application binary and details for a specific application platform. 22. Click Get Started. 23.(Application owners or co-owners only) On the Add New Platform page: Select the OS platform. Specify the form factor if the new app is for tablet or phone. Browse to, and upload the app binary SAP SE or an SAP affiliate company. All rights reserved. Application Management

23 The app binary must be smaller than 250 MB. The upload of.appx or.appxbundle files is not supported for Windows Phone 8.1 or higher devices. If you selected ios as the platform, select one of the following options for providing the mobile provisioning file: Embedded - ios mobile provisioning file is embedded in the IPA file. This option is the default. External - Browse for an ios mobile provisioning file, to upload with the application. You can upload an ios mobile provisioning file even if the application is in production state. Select the minimum OS version that the new app will support. 24.Click Multimedia to add videos and screenshots. For the application image or screenshot: Only png, jpeg, and jpg file formats are supported. The recommended resolution is 244px X 244px (thumbnail) and 640px X 480px if the image is expanded by clicking the thumbnail. For the video: Only mp4 file type is allowed. The maximum file size cannot exceed 35 MB. 25. Click Documents to add a document that contains additional information about the new application. Only doc, pdf, txt, ppt, pptx, and docx file types are allowed. The maximum file size of each document cannot exceed 35 MB. 26.Click Trial users to add one or more trial user who can test the application before it is published to all users. 27. Click Add Trial User. The Select Trial Users dialog is displayed. 28.Search trial users by username, first name, last name, or address and select the checkbox. Only users who are assigned the Mobile Place User role can be designated as trial user. 29.Click OK to close the Select Trial Users dialog. Selected trial users now appears on the Trial users page. 30.Click Save when prompted, to accept the updated supported OS and app version information. 31. Click OK to upload your new application. 32.Click OK to close the Edit Platform dialog. The Supported Platforms page is updated with supported OS version and app version information. 33.Click Save to save the supported platforms information. 34.On the Supported Platforms page, click the Actions icon to: Approve - send a notification to the App Catalog Administrator to approve if the platform state is in trial or production requested state. On approving a trial request or a production request, the Application Notification dialog appears. Choose whether to send the application notification to all subscribed users or to not send the notification. Reject - send a notification to App Catalog Administrator to reject if the platform state is in trial or production requested state. On rejecting a trial request or a production request, the Reject Trial Request Application Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 23

24 or Reject Production Request dialog is displayed and a reason must be provided by the App Catalog Administrator. Additional comments (optional) may also be provided. Request Trial - send a request to the App Catalog Administrator to publish the application in Mobile Place App Catalog for trial users to test the app. Set to Trial - send a notification to App Catalog Administrator to publish the application on the Mobile Place App Catalog for only trial users to install and test the app. Request Production - send a notification to the App Catalog Administrator to publish the application on the Mobile Place App Catalog to all the end users. If you modify or add a new platform and select this option, any existing platforms are removed from Mobile Place. Click OK to continue or Cancel to retain the current platform information. Set to Production - send a notification to the App Catalog Administrator to publish the application on the Mobile Place App Catalog for all users to access and install the application. On setting it to production, the Application Notification dialog appears. Choose whether to send the application notification to all subscribed users or to not send the notification. If you modify or add a new platform, and select Request Production or Set to Production, any existing platforms from Mobile Place. Click OK to continue or click Cancel to retain the current platform information. Retire - send a notification to the App Catalog Administrator to retire the application if it is in production. Once an application is retired, end users can no longer download it. However, users who have already installed the app can continue to use it. Delete - send a notification to the App Catalog Administrator to delete a retired application that is in production (when in New and Trial state but not in Requested state). If the application is in New state, the application can be deleted by the publisher as well. 35. You can also click the Edit icon in the Supported Platforms page to edit the platform. Publisher can edit any non-binary information in the "New" state. A user who is assigned the administrator rights can edit any nonbinary information at any point of time except that he cannot change anything once the application supported platform is in "Production" state. The application workflow state transition for App Catalog Admin role and App Catalog Publisher role is described in the tables below. Table 1: App Catalog Admin Role - Application Workflow State Transition State Can Edit Available Action Items New Yes, except OS platform and binary Request Trial, Set to Trial, Request Production, Set to Production, Delete Trial Requested Yes, except OS platform and binary Approve, Reject Trial Yes, except OS platform and binary Request Production, Set to Production, Delete Production Requested Yes, except OS platform and binary Approve, Reject Production No Retire SAP SE or an SAP affiliate company. All rights reserved. Application Management

25 State Can Edit Available Action Items Retired No Delete Table 2: App Catalog Publisher Role - Application Workflow State Transition State Can Edit Available Action Items New Yes, except OS platform and binary Request Trial, Request Production, Delete Trial Requested No None Trial No Request Production Production Requested No None Production No None Retired No None 5.3 Adding a Web Application An App Catalog Administrator or an App Catalog Publisher can add a Web application to publish an application on Mobile Place. Procedure 1. Click Applications. 2. From the Manage Apps tab, click New Application. 3. Select Web Application and click Next. 4. On the Details page: URL - Enter the full URL of the Web application along with the appropriate or prefix. Language - Select a language. The languages that are available depend on the language settings set on the Account Settings Mobile Place page. Name - On entering the URL, the Name field is automatically retrieved from the <title> element of the Web application; however you can edit it here. The name cannot exceed 250 characters including spaces. Description - Enter a description for the new application. The description cannot exceed 4000 characters including spaces. HTML content is supported. You can also apply styles to the description text, such as different fonts, text color, background color, and insert or unlink URLs.. After entering the text, select the text and Insert/Edit Link control. In the Insert/Edit Link window is displayed. Perform the following steps: 1. Enter the link URL. Application Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 25

26 2. In the Target field, specify whether the link is opened in the current window or a new one. 3. Enter the title and click Insert. Applying styles on the text affects the number of characters. Minimize style effects to maximize the number of characters you can enter. (Optional) Keywords - Enter keywords separated by commas that will help users in searching and retreiving the new Web application. Keywords must not exceed 100 characters. 5. (Optional) Select one or all of the following options: Deploy to managed devices only (Only Managed users) Mark as featured app Accessible to unauthenticated users By default, the checkbox Accessible to unauthenticated users is disabled. This checkbox is enabled only if unauthenticated access is enabled from Account Settings Mobile Place page. If Accessible to unauthenticated users check box is selected, an application is visible to unauthenticated users only. You can not select both the check boxes Deploy to managed devices only and Accessible to unauthenticated users at the same time. 6. Click Save to save the information on the Details page. 7. Click Groups, and select the visibility of the application to all users, or only to selected groups. You can search for an existing group by typing the group name in the search groups window. Use the Actions icon to sort the group list based on group name, or apply filters to search for a group. You can also create a new group, if required, by selecting the static or directory group option from the New group drop-down list. The newly created group is selected, by default. For more information on how to create groups, see Group Management section. 8. If you have chosen to show the application only to selected groups, select the required groups from the list. 9. (Optional) Click Multimedia. Upload an application icon or banner image that wiill appear in Mobile Place by clicking Browse button. The application icon must support the following properties: Only png, jpeg, and jpg file formats are supported. The recommended resolution is 76px X 76px. You can upload only one application icon. Icon will be retrieved from the <link rel="apple-touch-icon" href="[icon]> if one exists. If you do not upload an application icon, then the default application icon (below the Application icon field) is used. The banner image must support the following properties: Only png, jpeg, and jpg file formats are supported. The recommended resolution should be 1024px X 230px SAP SE or an SAP affiliate company. All rights reserved. Application Management

27 10. Click Save. You can upload only one banner image. Banner image is required if the app is marked as "Featured". 11. (Optional) Click Documents to add a document that describe more information about your new application. Only doc, pdf, txt, ppt, pptx, and docx file types are allowed. The maximum file size of each document cannot exceed 35 Mb. 12. Click Save to save the Documents page. 13. (Optional) Click Categories. To add a new Web application to available categories, double-click or drag and drop categories from Available box to Selected box. 14. Click Save to save the information in the Categories page. 15. Click Owner info to view owner information of a application and select up to five co-owners for a new application. 16. Click the Edit App Owner icon to change the application owner. Only users with App Catalog Admin role can edit the application owner. The Select Owner dialog is displayed. Only users who have App Catalog Admin and App Publisher roles are displayed. 17. Click on the radio button to select the user and click OK. App owner information is updated in the Owner info page. 18. Click Add Co-Owner to add new co-owner(s). The Select co-owners dialog is displayed. 19. Search for a co-owner by username, first name, last name, or address and select the checkbox to select a co-owner. Only users who are assigned the App Catalog Admin role or App Publisher role can be selected as coowners. 20.Click OK to close the Select Co-Owners dialog. Selected co-owners that were selected now appear in the Owner info page. 21. Click Save to save the information in the Owner info page. 22. Click Supported platforms to add application binary and details for a specific application platform. 23.Click Get Started. 24.On the Add New Platform page: Select the OS platform. Specify the form factor if the new app is for tablet or phone. From the Operating Systems Versions section, select the minimum OS version that the new app will support from the drop-down box. 25. Click Trial users to add a new trial user who can test the Web application before it is published to all users. 26.Click Add Trial User. Application Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 27

28 The Select Trial Users dialog is displayed. 27. Search trial users using username, first name, last name, or address and select the checkbox against the trial user. Only users who have Mobile Place User role is displayed. 28.Click OK to close the Select Trial Users dialog. 29.Click OK to close the Edit Platform dialog. The Supported Platforms page is updated with supported OS version and Web application version information. 30.Click Save. 31. On the Supported Platforms page, click the Actions icon to: Approve - send a notification to the request App Catalog Administrator to approve if the platform state is in trial or production requested state. On approving a trial request or a production request, the Application Notification dialog appears. Choose whether to send the application notification to all subscribed users or to not send the notification. Reject - send a notification to App Catalog Administrator to reject if the platform state is in trial or production requested state. On rejecting a trial request or a production request, the Reject Trial Request or Reject Production Request dialog is displayed and a reason must be provided by the App Catalog Administrator. Additional comments (optional) may also be provided. Request Trial - request the App Catalog Administrator to publish the Web application in Mobile Place App Catalog for trial users to test the app. Set to Trial - send a request for the App Catalog Administrator to publish the Web application on the Mobile Place App Catalog for only trial users to install and test the app. Request Production - send a request to App Catalog Administrator to publish the Web application on the Mobile Place App Catalog to all the end users. any existing platforms are removed from Mobile Place. Click OK to continue or Cancel to retain the current platform information. Set to Production - For the App Catalog Administrator to publish the Web application on the Mobile Place App Catalog for all users to access and install the application. On setting it to production, the Application Notification dialog appears. Choose whether to send the application notification to all subscribed users or to not send the notification. If you modify or add a new platform, and select Request Production or Set to Production, any existing platforms from Mobile Place. Click OK to continue or click Cancel to retain the current platform information. Retire - For the App Catalog Administrator to retire the Web application if it is in production. Once an application is retired, However, users who have already installed the app can continue to use it. Delete - For the App Catalog Administrator to delete a retired Web application that is in production (when in new and trial state but not in requested state). If the Web application is in new state, the Web application can be deleted by the publisher as well SAP SE or an SAP affiliate company. All rights reserved. Application Management

29 32.You can also click the Edit icon in the Supported Platforms page to edit the platform. Publisher can edit any non-binary information in the "New" state. A user who is assigned administrator rights can edit any nonbinary information at any point of time except that he cannot change anything once the application supported platform is in "Production" state. The application workflow state transition for App Catalog Admin role and App Catalog Publisher role is described in the tables below. Table 3: App Catalog Admin Role - Application Workflow State Transition State Can Edit Available Action Items New Yes, except OS platform and binary Request Trial, Set to Trial, Request Production, Set to Production, Delete Trial Requested Yes, except OS platform and binary Approve, Reject Trial Yes, except OS platform and binary Request Production, Set to Production, Delete Production Requested Yes, except OS platform and binary Approve, Reject Production No Retire Retired No Delete Table 4: App Catalog Publisher Role - Application Workflow State Transition State Can Edit Available Action Items New Yes, except OS platform and binary Request Trial, Request Production, Delete Trial Requested No None Trial No Request Production Production Requested No None Production No None Retired No None 5.4 Adding an ios or Windows Application from a Commercial App Store An App Catalog Administrator or an App Catalog Publisher can add an ios or Windows application from a commercial app store to be published on Mobile Place. Procedure 1. Click Applications. 2. From the Manage Apps tab, click New Application. Application Management 2016 SAP SE or an SAP affiliate company. All rights reserved. 29

30 3. Select Commercial App Store and select one of the following: 4. Click Next. Apple App Store Windows Phone Store 5. On the Details page: Country - Select a country. The Country field is disabled on Windows Phone devices. Language - Select a language. Only English is supported for Windows commercial applications. The languages that appear depends on the language settings set in the Account Settings Mobile Place page. If you select: Name - Enter the name of the application. After you save the application, you cannot edit the name of the application. URL - Copy the URL of the application from the app store. (Optional) Description - If you select: App Store: The information in the description field is automatically populated from the app store. You cannot edit this information. Enterprise: Enter custom description or information for this app. App publisher or app catalog admin can: select only one type of description for the app to be published to the Mobile Place users switch to any type of description at any point of time. Last save description will be published to the Mobile Place users (Optional) Keywords - Enter keywords separated by commas that will help users in searching and retrieving the new application. Each keyword cannot exceed 60 characters. 6. (Optional) Select one or all of the following options: Deploy to managed users only - The application is accessible only to Managed users. Mark as featured app - The application will appear on the banner area in Mobile Place and you will be prompted to provide a banner image Accessible to unauthenticated users By default, the checkbox Accessible to unauthenticated users is disabled. This checkbox is enabled only if unauthenticated access is enabled from Account Settings Mobile Place page. If Accessible to unauthenticated users check box is selected, an application is visible to unauthenticated users only. 7. Click Save. You can not select both the check boxes Deploy to managed devices only and Accessible to unauthenticated users at the same time. The platform is also created SAP SE or an SAP affiliate company. All rights reserved. Application Management