SAP Afaria Document Version: 7 SP05-2014-09-03 CUSTOMER SAP Afaria Windows Phone and Windows 8.1 Enrollment
Table of Contents 1 Windows 8.1 Device Enrollment....3 1.1 Enrolling a Windows 8.1 Device Using Self-Service Portal.... 3 1.2 Enrolling a Windows 8.1 Device using Domains....5 2....7 2.1 Enrolling Windows Phone Devices in Management....8 2.2 Enabling Location Service on the Windows Phone Device....12 2.2.1 Accepting or Rejecting Location Collection....14 2.3 Renewing Certificates on the Windows Phone Device.... 15 2.4 Removing Windows Phone Devices from Afaria Management....16 2 2014 SAP SE or an SAP affiliate company. All rights reserved. Table of Contents
1 Windows 8.1 Device Enrollment Windows 8.1(Windows DM) devices provide a built in device management client that communicates with the Afaria server. These devices can be enrolled in management either from the Self-Service Portal by activating the enrollment code, or directly from the device using domains. Using Self-Service Portal 1. Access Self-Service Portal on the device and activate the enrollment code. 2. Navigate to Workplace on the device, provide your user ID to create a workplace account. 3. Enter the server address URL (if provided), and turn on device management for the device. 4. On the login page, provide the user credentials for authentication, and log in to management. 5. Accept the agreement regarding apps and services from IT admin, and the device gets enrolled in Afaria management. Using Domains 1. On the Afaria Administration console, create a new domain for enrolling the Windows DM device. 2. Navigate to Workplace on the device, provide your user ID to create a workplace account, and enable and turn on device management for the device. Based on the domain name in the user ID, the auto-discovery service retrieves the server details for enrolling the device. 3. On the login page, provide the user credentials for authentication, and log in to management. 4. Accept the agreement regarding apps and services from IT admin, and the device gets enrolled in Afaria management. Afaria application silently installs on the device, after the device is enrolled in management. 1.1 Enrolling a Windows 8.1 Device Using Self-Service Portal Enroll a Windows DM (Windows 8.1) device in Afaria management using the enrollment code activated on the Self- Service Portal. Prerequisites Ensure that you have a Self-Service Portal user account. Ensure that in the Afaria Administration console, there is an enrollment policy for the Windows DM device. Windows 8.1 Device Enrollment 2014 SAP SE or an SAP affiliate company. All rights reserved. 3
Procedure 1. On the device, sign in to the Self-Service Portal, providing your login credentials. The Self-Service Portal URL is either sent to you, or made available on the corporate portal. 2. On the portal home page, click or tap Enroll New Device. 3. Click Activate Enrollment Code. 4. Exit from the portal, and navigate to PC Settings Network Workplace to configure a workplace user account. 5. Enter your user ID to create a workplace account. The user ID must be specified in the format 'user@domain.com' or 'domain/user'. 6. Enter the server address URL, if provided by your system administrator. 7. Click Turn On to initiate device management. 8. On the authentication page, enter the user credentials for authentication and click Log on. 4 2014 SAP SE or an SAP affiliate company. All rights reserved. Windows 8.1 Device Enrollment
After successfully connecting to the Afaria server for enrollment, you see an agreement message regarding apps and services from IT admin. 9. Accept the agreement, and click Turn On to complete the enrollment. 1.2 Enrolling a Windows 8.1 Device using Domains Enroll a Windows 8.1 (Windows DM) device in Afaria management using the domain details configured on the Afaria Administration console. Prerequisites Configure your domain on the Afaria Administration console. Windows 8.1 Device Enrollment 2014 SAP SE or an SAP affiliate company. All rights reserved. 5
Procedure 1. On the device, navigate to PC Settings Network Workplace to configure a workplace user account. 2. Enter your user ID and click Turn On to initiate device management. Based on the domain name in the user ID, the auto-discovery service retrieves the server details for enrolling the device, and you see a login page for user authentication. 3. Enter the user credentials for authentication and click Login. After the devcice successfully connects to the Afaria server for enrollment, you see an agreement message regarding apps and services from IT admin. 4. Accept the agreement, and click Turn On to complete the enrollment. 6 2014 SAP SE or an SAP affiliate company. All rights reserved. Windows 8.1 Device Enrollment
2 Enroll Windows Phone devices by activating the enrollment URL on the Self-Service Portal, and creating company apps/workplace user account to sign in to Afaria management. After enrollment, during the first connection to the Afaria server, the Afaria application is silently installed on the device. Using Self-Service Portal 1. Access the Self-Service Portal on the device and activate the enrollment code URL. 2. Enter values for user variables on the portal, if variables are configured in the enrollment policy. The variable prompts appear for user input only if the enrollment happens through the Self-Service Portal. 3. To enroll a device, provide valid credentials to create a company apps/workplace user account. 4. If prompted for a server address on the device, enter the enrollment code URL, and provide the user credentials when prompted. During enrollment, the Afaria application installs on the device, silently. 5. (Optional) On the device, install enterprise or Windows store apps, as you require. All the associated enterprise and Windows store apps are listed when you launch the Afaria application on the device. Note If you use a slow-speed internet connection (2G or a similar connection) to connect to the Afaria server, the Afaria application and the enterprise applications installed through Afaria are only queued for downloading and installing. 6. To remove the device from Afaria management, delete the company apps/workplace account from the device. Afaria application and all the enterprise apps installed through Afaria are removed when you delete the company apps/workplace account. 2014 SAP SE or an SAP affiliate company. All rights reserved. 7
Figure 1: in Afaria Management 2.1 Enrolling Windows Phone Devices in Management Enroll a Windows Phone device in Afaria management by activating an enrollment code URL in the Self-Service Portal, and creating a company apps or workplace account to enroll the device. Prerequisites If you are using Self-Service Portal, ensure that a Self-Service Portal user account is created for you. If you are not using Self-Service Portal, ensure that your domain is already configured on the Afaria Administration console. 8 2014 SAP SE or an SAP affiliate company. All rights reserved.
Context This procedure provides a sequential diagrammatic representation of the Windows Phone enrollment process. Note If you are not using Self-Service Portal for enrollment, skip steps 1 4. Procedure 1. On the device, sign in to the Self-Service Portal, providing your login credentials for authentication. The Self-Service Portal URL is either sent to you, or made available on the corporate portal. 2. On the portal home page, tap Enroll New Device. 2014 SAP SE or an SAP affiliate company. All rights reserved. 9
3. Tap the Activate Enrollment Code URL option. 4. Enter values for the user variables, as they are configured on the Afaria Administration console. 10 2014 SAP SE or an SAP affiliate company. All rights reserved.
The variable prompts appear for user input only if the enrollment happens through the Self-Service Portal, and only the variables configured in the enrollment policy appear for user input. 5. Exit the portal, and navigate to Settings company apps/workplace on the device. On a Windows Phone 8.1 device, tap Go To Workplace to move to workplace directly. 6. Tap add account to create a user account to connect to the Afaria server. 7. Enter email address and tap sign in. 8. Enter password if prompted for, and tap sign in. Note The password prompt appears only if auto-discovery service has been configured on the Afaria server. If not configured, the device prompts for server adress. Enter the enrollment code URL that was activated on the Self-Service Portal, and tap sign in. 9. Enter Email address, Password, Username, and Domain details, and tap sign in. This screen appears only if auto-discovery is not configured on the Afaria server. The details you must enter vary based on the type of authentication used, whether NT domain-based or Active Directory authentication. NT domain-based authentication the enrollment server should use Windows authentication. Details to be entered for the company apps account: Email address in the format username@domain.com. Need not be a valid Id. Password required. Should match the user's credentials. Username required. Valid user name for the defined NT domain. Domain required. Should match the format defined under the Security settings. Active Directory authentication the enrollment server should use Afaria managed authentication. Details to be entered for the company apps account: Email address required in the User Principal Name (UPN) format username@domain.com. 2014 SAP SE or an SAP affiliate company. All rights reserved. 11
Password required. Should match the user's credentials. Username not required. Domain not required. If you use directory substitution variables with Active Directory authentication, you must leave Username and Domain fields blank, so that the user name is pulled back in for directory variable substitution. For Afaria managed authentication, the login prompt on the Afaria application appears only if the 'Enable authentication' option is enabled on Server Configuration Security page. LDAP-based authentication is supported using UPN(User Principal Name) format (user@domain), but samaccountname format (domain\user) is not supported for enrolling Windows Phone devices. The device uses the Server address to enroll in Afaria management. 10. Tap done to complete the enrollment. The Afaria application installs on the device, if the signed Afaria application (.xap) file has been uploaded in the Afaria Administration console. 2.2 Enabling Location Service on the Windows Phone Device Configure the location parameter on the device to enable location services. Prerequisites Ensure that 'Enable Activity Collection' and 'Collect Subscriber Location Information' options are enabled in Server Configuration Device Activity page on the Afaria Administration console. Location collection will be enabled only if the Afaria application is launched at least once on the device. 12 2014 SAP SE or an SAP affiliate company. All rights reserved.
Procedure 1. On the device, navigate to the Settings page. 2. Tap location. 3. Tap and change the Location services toggle switch to 'On'. 2014 SAP SE or an SAP affiliate company. All rights reserved. 13
2.2.1 Accepting or Rejecting Location Collection Accept or reject location information collection on the device. Location collection is enabled on the device, based on the device activity settings configured on the Afaria Administration console. Procedure 1. Launch the Afaria application on the device. The device activity collection prompt appears, if configured on the Administration console. 2. Tap accept if you agree for location collection. A background service enabled for the Afaria application, runs along with other scheduled operating system tasks and collects device activity data. 3. To reject location collection, tap cancel on the device activity prompt page. 14 2014 SAP SE or an SAP affiliate company. All rights reserved.
2.3 Renewing Certificates on the Windows Phone Device Renew the certificate on the Windows Phone device on or before the expiry of the certificate. Context For renewing certificate, an attention alert appears on the device, based on the certificate renewal alert duration configured on the Afaria Administration console. Procedure 1. On the device, navigate to the Settings company apps/workplace page. 2. Tap the highlighted Attention required message. 2014 SAP SE or an SAP affiliate company. All rights reserved. 15
3. Enter the Password. 4. Tap done. The certificate is renewed on the device. 2.4 Removing Windows Phone Devices from Afaria Management Remove Windows Phone devices from Afaria management either directly from the device, or remotely by the administrator. Prerequisites The Windows Phone device should be enrolled in Afaria management. Context This procedure provides a sequential diagrammatic representation of the disconnection of Windows Phone devices from Afaria, initiated from the device. 16 2014 SAP SE or an SAP affiliate company. All rights reserved.
Procedure 1. On the Windows Phone device, navigate to the Settings company apps/workplace page. 2. Tap the Delete icon to delete the company apps/workplace account. 3. On the Settings company apps/workplace page, verify that the Afaria account details are removed. 2014 SAP SE or an SAP affiliate company. All rights reserved. 17
Note Afaria application and all the enterprise apps installed through Afaria will be removed when you delete the company apps account. While disconnecting from Afaria management, the Exchange e-mail account configured by Afaria on the device will also be removed, although the message that appears on the device may indicate otherwise. 18 2014 SAP SE or an SAP affiliate company. All rights reserved.
Important Disclaimers on Legal Aspects This document is for informational purposes only. Its content is subject to change without notice, and SAP does not warrant that it is error-free. SAP MAKES NO WARRANTIES, EXPRESS OR IMPLIED, OR OF MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. Coding Samples Any software coding and/or code lines / strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence. Accessibility The information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP specifically disclaims any liability with respect to this document and no contractual obligations or commitments are formed either directly or indirectly by this document. Gender-Neutral Language As far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible. Internet Hyperlinks The SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. Regarding link classification, see: http:// help.sap.com/disclaimer. Important Disclaimers on Legal Aspects 2014 SAP SE or an SAP affiliate company. All rights reserved. 19
www.sap.com/contactsap 2014 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Please see http://www.sap.com/corporate-en/legal/copyright/ index.epx for additional trademark information and notices.