Information Services Revised 15.10.15 ISD Customer Services Configuring an Android device to access Staff Wi-Fi and Email. Screenshots provided from Google Nexus, Android version 4.2.1 Jelly Bean. Important Note: Information Services cannot be held responsible for any loss of personal data which occurs as a result of following these instructions. Users must backup their device as a mandatory requirement before following any advice or instructions provided. Table of Contents 1 Android Security Best Practice Page 1-3 2 eduroam Wi-Fi Connection Page 4 5 3 Staff Exchange Email Configuration Page 6 9 4 Performing a Remote Wipe from Outlook Web App Page 9 1. Android Security Best Practice This section outlines the main aspects of security best practice for Android Devices. ISD would strongly recommend the use of these features, whether you access University Wi-Fi or Email services from your personal device or not, since they will help to protect your data in the event your device is lost. Screen Security Please Note: a Screen lock is a mandatory requirement of ActiveSync email connection (see section 3). Within the Android Settings, select Security (under the Personal grouping) and select Screen lock. The default option is Slide. The options are shown below. 1
ISD recommend minimum security is a PIN of at least 4 digits (the minimum length that Android will allow to be set). Follow the prompts to ensure the PIN is set and confirmed. Subsequently, each time the device is locked then the user will be prompted with the PIN challenge as shown. Enter the PIN and then the Enter key (bottom right). This will ensure your device is locked when not in use, to help prevent unauthorised access. This setting should be switched on during initial device setup. Device Encryption Information Services recommend that if your Android device supports encryption, it should be enabled to help prevent unauthorised access to your data in the event the device is lost. Use of only a Screen lock setting may not fully cover all possible data security risk scenarios. Encryption will set a numeric PIN or Password (note: this is independent of the Screen lock security setting) which will be required each time the device is switched on from fully powered off. Please Note: device encryption is a mandatory requirement of ActiveSync email connection (see section 3). Android device encryption is possible on any storage compliant device using Android Ice Cream Sandwich 4.0 or above. You should consult your device s user guide to establish if encryption is supported. 2
Encryption is irreversible, so once completed a Factory Data Reset of the device will be required to unencrypt. This is done via the Settings, Backup & Reset options. Users should fully understand this before proceeding. Please Note: a device backup must be taken, and any personal data on the device should be copied to a safe location (e.g. an attached computer) prior to encryption Within the Android Settings, select Security (under the Personal grouping) and select Encryption. As stated in the screenshot below, encryption can only take place when the device is fully charged and connected to the power charger. Select Encrypt tablet. Follow the prompts to enter the numeric PIN or Password and confirm it. When the process has completed, the user will note the challenge for the numeric PIN or Password when powering on the device. Note that the Encryption PIN/Passcode and Screen lock PIN/Password are completely independent of each other and it is not recommended to set the same value for both. However, since the Encryption Pin/Passcode will only be used after a full power off-on rather than each time the device is inactive, then it must be something which the user will easily remember! 3
2. eduroam Wi-Fi Connection Please note: eduroam Wi-Fi authenticates staff members with either an Employee code (e-code) or an Associate code (a-code). The Visitor WLAN is also available as appropriate. Ulster uses a CA security certificate for eduroam so that you can check and have confidence that you are connected to the genuine eduroam service only. It is necessary to install this certificate, as follows: Using the web browser on your device, go to the Ulster eduroam support page at http://www.ulster.ac.uk/eduroam Browse to the eduroam Home Service Setup section and click on the Download Security Certificate for Android link From the notifications (small icons at top left of screen, activated by sliding finger down), select AddTrustExternalCARoot by clicking on it, name it Ulster and select OK. 4
Within the Android Settings, select Wireless & Networks and ensure Wi-Fi is turned on. While on a University Campus, the device should find several Wi-Fi networks, one of which will be eduroam. If eduroam is not shown in the available list on your device, please move physical location and try again. You will be prompted with the eduroam Wi-Fi settings, as below: Ensure that the EAP Method is set to PEAP and the Phase 2 authentication is set to MSCHAPV2. Set the CA Certicate to Ulster (or the name you downloaded earlier). Leave User Certificate blank. Enter your staff username (your e-code or a-code) in the Identity field in the following format: <e-code>@ad.ulster.ac.uk Leave Anonymous Identity blank. Enter your current staff password in the Password field, as shown. Then select Connect. You should then see the device making the connection attempt and you will see the status change to Connected. eduroam will reconnect (as long as the login credentials remain valid within the 180-day password life) whilst the device is in range. If you no longer required, please hold down on eduroam and select Forget. 5
3. Staff Exchange Email Configuration It is important to note that all staff members with Android devices who wish to use corporate e-mail via ActiveSync will be required to enable or agree to: remote locking on their mobile device remote wipe/data removal on their mobile device a Screen lock PIN/Password on their mobile device encryption of the mobile device Please Note: see Section 1: Android Best Security Practice for further advice on the Screen lock and Encryption features, before attempting connection to email via ActiveSync. Those staff who cannot or do not wish to enable these features may still access their corporate email accounts on their personally owned mobile devices through the Web via Outlook Web App (OWA) at https://mail.ulster.ac.uk/owa. If the user accepts these features, then within the Android Apps screen, select the Email app. Once the Account setup screen launches, type your University email address and password into the fields, and then select Manual setup. In Account type, select Exchange. 6
Modify Domain\Username to be ad\<your e-code> and modify the Server to be mail.ulster.ac.uk. Then select Next. The device should then display a Checking incoming server settings progress dialogue box. On the Remote Security Administration dialogue, select OK to permit the prerequisite security features to be implemented. On the Account Options screen, the Inbox checking frequency and Days to sync can be modified. If a 3G connection is in use in addition to Wi-Fi, it may be a user wish to modify settings to cater for the slower and possibly metered data plan. If Contacts and Calendar are synched, then the Calendar App will sync with your Outlook Calendar and the People App will sync with Outlook Contacts. Please Note: Subsequently removing the email account (via Email Settings, Remove Account) will also remove the synced information from Calendar and People. The sync and other general settings can also be modified at any time via Email Settings. 7
For the account name, use your University email address as shown. Please Note: If prompted during setup by any Security Update dialogue as below, select OK. Failure to do so, by selecting Cancel will cause the mail setup to cancel since your device will consequently not meet minimum security standards. This dialogue box may appear more than once during the ActiveSync setup. This also applies for the Activate Device Administrator dialogue box, as shown below. Note that this screen may appear different dependant on your Android device and operating system version, but the principle will remain the same you should select Activate (or similarly worded option as appropriate) to enable the security features, otherwise the ActiveSync setup will cancel. You should follow the advice given in Section 1: Android Security Best Practice before attempting the ActiveSync setup, as advised. Selecting Activate will have minimal effect on your device at that point, if so. Otherwise the ActiveSync setup may either fail due to a missing prerequisite or start to implement the activation of these security features. Once Activate is selected, you should see the following dialogue as below: 8
Your email mailbox should appear and will then be fully synched with the email mailbox when used via Outlook (on your Ulster workstation) and Outlook Web App at https://mail.ulster.ac.uk/owa. The EMail App buttons as shown below - in order from left to right: Compose New Message, Search, Manual Sync, Settings. The Settings option can be used to refine the Email App regards account settings, data usage, notification settings, server settings and to remove the account if no longer required on the device. 4. Performing a Remote Wipe from Outlook Web App If a staff member loses their Android device and wishes it to be remotely wiped of all data this can be reported to ISD via the ISD Service Desk (servicedesk@ulster.ac.uk or Ext 66777) or self-serviced via Outlook Web App (OWA) at https://mail.ulster.ac.uk/owa Please note: a Remote Wipe will reset the device to factory default, which will include the loss of all data, including personal data, which has not been previously backed up (such as pictures and other media files). Please refer to the Remote Wipe FAQ at http://ulster.ac.uk/isd/help/faqs/remote-wipe for further guidance. 9