Sophos Mobile Control Super administrator guide. Product version: 3

Sophos Mobile Control Super administrator guide Product version: 3 Document date: January 2013

Contents 1 About Sophos Mobile Control...3 2 Super administrator accounts...4 3 The super administrator customer...5 4 Log in to the super administrator customer...6 5 Configure technical contact...7 6 Enable Sophos Mobile Security management...8 7 Manage customers...9 8 Manage configurations, settings and packages...16 9 Define customer preselection settings for login to the Self Service Portal...19 10 Configure SCEP for ios devices...20 11 Export a device report for all customers...21 12 Download log files...22 13 Create new super administrators...23 14 Technical support...24 15 Legal notices...25 2

Super administrator guide 1 About Sophos Mobile Control Sophos Mobile Control is a device management solution for mobile devices like smartphones and tablets. Sophos Mobile Control helps to keep corporate data safe by managing apps and security. The Sophos Mobile Control system consists of a server and a client component which communicate through data connections and text messages. The Sophos Mobile Control client is easily installed and managed with over-the air setup and configuration through the Sophos Mobile Control web console. With the Sophos Mobile Control Self Service Portal for your users, you can reduce IT efforts by allowing users to register their own devices and carry out other tasks without having to contact the helpdesk. Sophos Mobile Control currently supports the following mobile device platforms: Android Apple ios Windows Mobile BlackBerry (through BlackBerry Enterprise Server) Note: For BlackBerry devices only selected functions are supported. The Self Service Portal does not support BlackBerry devices. Due to the nature of the different platforms supported features vary. For a matrix of the features supported for the different platforms, refer to the Sophos Mobile Control technical guide. 1.1 About this guide This guide describes how to carry out super administrator specific tasks in the Sophos Mobile Control web console. For a description of the Sophos Mobile Control web console for regular administrators, see the Sophos Mobile Control administrator guide. Besides the description of the web console for regular administrators, you also find general information (for example prerequisites) and task descriptions in the Sophos Mobile Control administrator guide. General information and user interface descriptions in the administrator guide also apply to the super administrator, unless stated otherwise in this super administrator guide. 3

Sophos Mobile Control 2 Super administrator accounts A super administrator has specific rights and tasks in Sophos Mobile Control administration. The first super administrator account is created during Sophos Mobile Control configuration. With a super administrator account you log on to the super administrator customer. This customer is also created during Sophos Mobile Control configuration. For further information, see the Sophos Mobile Control installation guide. The Sophos Mobile Control web console shows a specific view for the super administrator customer. As a super administrator you can switch from the super administrator customer to other customers any time after login. You can also create new super administrators in the super administrator customer. 2.1 Super administrator rights and tasks After Sophos Mobile Control installation, the system needs to be set up and customers need to be configured. In Sophos Mobile Control, customers are the tenants that manage the devices of their users. The super administrator is primarily used to set up and manage customers for device management. As a super administrator, you can: configure technical contact information enable Sophos Mobile Security management by activating and assigning the relevant licenses Note: Sophos Mobile Security management is an optional Sophos Mobile Control module. For further information, see Enable Sophos Mobile Security management (section 6). create and manage customers define settings and packages and clone them to new customers define new settings, configurations and profiles for Android, ios and Windows Mobile and push them to existing customers configure SCEP for ios devices export a list of all managed devices for all customers download all log files from the server as a.zip file create other super administrator accounts 4

Super administrator guide 3 The super administrator customer The super administrator customer is created during Sophos Mobile Control configuration together with the first super administrator account. For further information, see the Sophos Mobile Control installation guide. The super administrator customer offers a specific view of the Sophos Mobile Control web console. This view is customized for super administrator tasks. The main differences between the super administrator customer web console view and the view for other customers and administrators are: Devices and Tasks are not available in the menu. Note: As devices are not available, the Dashboard does not show a view of all managed devices and no new devices can be added to the super administrator customer. Devices can only be added in the customers created by the super administrator. For adding devices you have to switch from the super administrator customer to a regular customer, see Switch to other customers (section 4.1). In the Compliance Settings view, the button Check now is not available. To check devices for compliance according to the criteria defined, you need to switch to the relevant customer. Two additional buttons are available in the Dashboard: The Creates a report of all customers' devices (CSV file) button for exporting a list of all managed devices for all customers The Download log files (ZIP file) button for downloading all log files in a.zip file In the SMSec tab of the Settings view, an additional License key field is available for activating the licenses for Sophos Mobile Security management. For a description of the web console interface for regular customers and administrators, refer to the Sophos Mobile Control administrator guide. 5

Sophos Mobile Control 4 Log in to the super administrator customer Prerequisites: A super administrator customer has been created during Sophos Mobile Control configuration. For further information, see the Sophos Mobile Control installation guide. A super administrator account has been created and you have the credentials for the account. 1. Enter the Sophos Mobile Control web console URL in your preferred web browser. The Sophos Mobile Control login page is displayed. 2. In the Customer field, enter the super administrator customer. 3. In the User and Password fields, enter your super administrator user name and password. 4. Click Login. You are logged in to the super administrator customer. The super administrator costumer Dashboard is displayed. In the Customer field, the super administrator customer is marked by an asterisk and shown at the top of the dropdown list. 4.1 Switch to other customers After you have logged in to the super administrator customer, you can easily switch to other existing customers: 1. In the super administrator Dashboard, go to the Customer field. 2. Select the required customer from the dropdown list. The Sophos Mobile Control web console Dashboard for the selected customer is displayed. For further information, see the Sophos Mobile Control administrator guide. 6

Super administrator guide 5 Configure technical contact In the web console, you can configure technical contact information to support users in case of questions or problems. Prerequisite: To edit the technical contact information, you must have the user role Administrator. 1. In the Dashboard view, click the Technical contact button. The Technical contact view is displayed. 2. Click the Edit button. The fields in the Technical contact view become available for editing. 3. Enter the required information for the technical contact. Under Additional information, you can enter any additional information for supporting users in case of questions or problems 4. Click the Save button. The technical contact information is displayed when users click the Technical contact button in the Dashboard. For end users the technical contact information is shown in the Sophos Mobile Control app on ios and Android devices. It is also shown when end users click the Help button in the Self Service Portal. When you create a create a new customer and select Clone settings - Settings and packages, the technical contact information is automatically copied to the new customer. 7

Sophos Mobile Control 6 Enable Sophos Mobile Security management Sophos Mobile Security is a security app for Android phones and tablets that protects devices from malicious apps and assists end users in detecting apps permissions that could be a security risk. Sophos Mobile Security management is an optional Sophos Mobile Control module. For managing the Sophos Mobile Security app from Sophos Mobile Control, a license needs to be available and activated in the Sophos Mobile Control web console. As a super administrator, you can activate a purchased Sophos Mobile Security license in the super administrator customer and assign the required number of licensed clients to individual customers. For further information on managing Sophos Mobile Security from the Sophos Mobile Control web console, see the Sophos Mobile Control administrator guide. 6.1 Activate Sophos Mobile Security licenses 1. In the Dashboard view of the super administrator customer, click the Settings button. The Settings view is displayed. 2. Go to the SMSec tab. 3. In the License key field, enter the license key you have received from Sophos and click Activate. The Sophos Mobile Security license is activated. The Active license key field shows the activated license key. The Number of clients field shows the number of available clients. The Valid until field shows the license expiry date. In the Dashboard, the relevant license information is shown in the SMSec line in the fields Managed devices, Licensed devices and License valid until. You can assign the required number of licensed clients to individual customers when you create or edit customers. 6.2 Assign licensed clients to customers 1. Create a new customer or open an existing one for editing, see Create customers (section 7.2) or Edit customers (section 7.4). The Edit customer view is displayed. 2. In the Sophos Mobile Security licenses field, enter the number of licensed clients for Sophos Mobile Security management for this costumer. 3. Click the Save button. 8

Super administrator guide 7 Manage customers After Sophos Mobile Control installation and setup, a key step required for using Sophos Mobile Control is to create at least one customer, this means a tenant whose devices are managed in Sophos Mobile Control. As a super administrator you use the super administrator customer to create and manage customers for device management with Sophos Mobile Control. 7.1 Customer overview in the Dashboard In the super administrator customer Dashboard under Costumer management, an overview on all existing regular customers is shown in a table. This table shows the following information: Column Name Activated Valid until Max. devices Devices AND BB ios WIN Description Shows the name of the customer. Indicates if the customer is activated. Shows the expiry date of the customer, if specified. Otherwise this column shows unlimited. When the expiry date for a customer has passed, the date in the Valid until column is shown in red. Shows the maximum number of devices that can be registered for the customer, if specified. Otherwise this column shows unlimited. Shows the number of devices registered for this customer. Shows the number of Android devices registered for this customer. Shows the number of BlackBerry devices registered for this customer. Shows the number of ios devices registered for this customer. Shows the number of Windows Mobile devices registered for this customer. 9

Sophos Mobile Control Column Directory SMSec Managed SMSec Description Indicates the type of user management used for the customer: internal directory, external directory or none. Shows the number of available licences for Sophos Mobile Security management for this customer. For further information, see Enable Sophos Mobile Security management (section 6). Shows the number of licenses for Sophos Mobile Security management used for this customer. If the number of available licenses is exceeded, the value in this column is shown in red. Under Customer management, you can create, view, edit and delete customers. 7.2 Create customers 1. In the super administrator customer Dashboard under Customer management, click the Create new customer button. 2. The Edit customer view is displayed. 3. Enter a Name and a Description for the new costumer. 4. In the Maximum number of devices field, define how many devices can be managed for this customer. 5. In the Valid until field, specify the expiry date for the customer. If you do not specficy an expiry date here, unlimited is shown in the Valid until column in the costumer overview. 6. Under Activated platforms, select the platforms for which devices may be registered for the customer. 7. Under Located devices, select Localization activated to enable users to locate their devices if they are lost or stolen. Select Localization for Administrator to enable administrators to locate devices. 8. If you have activated a Sophos Mobile Security license for managing Sophos Mobile Security from the Sophos Mobile Control web console, the Sophos Mobile Security licenses field is displayed. Enter the number of licensed clients for Sophos Mobile Security management for this costumer. For further information, see Enable Sophos Mobile Security management (section 6) and the Sophos Mobile Control administrator guide. 9. Under Clone settings - Settings and packages, you can select that all settings and packages should be cloned for this customer. 10

Super administrator guide 10. Under User directory, select the data source for the Self Service Portal (SSP) users to be managed by Sophos Mobile Control: None. No SSP and user-specific profiles available. Select Internal directory to use internal user management for users of the Sophos Mobile Control Self Service Portal. For further information, see the Sophos Mobile Control administrator guide. Select External directory to use LDAP user management for users of the Sophos Mobile Control Self Service Portal. Click Configure external LDAP to specify the LDAP server details, see Configure LDAP connection for Self Service Portal user management (section 7.3). 11. Click the Save button. The customer is created and displayed in the customer overview table under Customer management in the Dashboard. You can switch to the new customer by using the Customer field in the Dashboard. 7.3 Configure LDAP connection for Self Service Portal user management For the Sophos Mobile Control Self Service Portal, LDAP user management can be used. With LDAP user management, you can assign phones to groups and profiles based on group membership. The Self Service Portal allows end users to register their own devices and carry out other tasks without having to contact the helpdesk. For further information on how to configure settings for the Self Service Portal, see the Sophos Mobile Control administrator guide. As a super administrator, you can configure an LDAP connection for a costumer to use LDAP user management for Self Service Portal users. 7.3.1 Configure LDAP connection for Active Directory 1. Create a new customer or open an existing one for editing, see Create customers (section 7.2) or Edit customers (section 7.4). The Edit customer view is displayed. 2. Under User directory, select External directory to use LDAP user management for users of the Sophos Mobile Control Self Service Portal. 3. Click Configure external LDAP to specify the LDAP server details. The LDAP Server Details view is displayed. 11

Sophos Mobile Control 4. In this view, enter the following: a) In the Primary URL field, enter the URL of the LDAP server. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. b) In the Backup URL field, enter the URL of the backup server. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. c) In the User field, enter a user who has reading rights for the LDAP server. You need to enter the user with the relevant domain. Supported formats are: <domain>\<user name> or <user name>@<domain>.<domain code>. d) In the Password field, enter the password for the user. Click Next. The LDAP Searchbase view is displayed. 5. Select the LDAP searchbase. The LDAP searchbase defines where to search for the user/the group that tries to log in to the Self Service Portal. Click Next. The LDAP Search Fields view is displayed. 6. In this step, you define which LDAP fields are to be used for resolving the placeholders %_USERNAME_% and %_EMAILADDRESS_% in profiles. Select the required fields from the User name and Email dropdown lists. Note: The fields listed are the LDAP fields defined for the user you have specified. For example: If no email adress is defined for this user, the mail field is not listed. You can enter field names manually. Click Next. The LDAP SSP Configuration view is displayed. 7. In the SSP group field, enter the name of the group that is to be allowed to log on at the Self Service Portal. This group has to be defined on the LDAP server. After you have entered the group, click the Resolve group button to resolve the group name into a complete Distinguished Name (DN). 8. Click the Finish button. The Edit customer view is displayed again. 9. Click the Save button to save your changes. 7.3.2 Configure LDAP connection for Novell edirectory 1. Create a new customer or open an existing one for editing, see Create customers (section 7.2) or Edit customers (section 7.4). The Edit customer view is displayed. 12

Super administrator guide 2. Under User directory, select External directory to use LDAP user management for users of the Sophos Mobile Control Self Service Portal. 3. Click Configure external LDAP to specify the LDAP server details. The LDAP Server Details view is displayed. 4. In this view, enter the following: a) In the Primary URL field, enter the URL of the LDAP server. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. b) In the Backup URL field, enter the URL of the backup server. You can enter the server IP or the server name. Select SSL to use SSL for the server connection. c) In the User field, enter a user who has reading rights for the LDAP server. You need to enter the user with the relevant domain. d) In the Password field, enter the password for the user. Click Next. The LDAP Searchbase view is displayed. 5. Leave the LDAP Searchbase view empty and click Next. The LDAP Search Fields view is displayed. 6. In this step, you define which LDAP fields are to be used for resolving the placeholders %_USERNAME_% and %_EMAILADDRESS_% in profiles. Select the required fields from the User name and Email dropdown lists. Usually "uid" and "mail" are used. Click Next. The LDAP SSP Configuration view is displayed. 7. In the SSP group field, enter the name of the group that is to be allowed to log on at the Self Service Portal. This group has to be defined on the LDAP server. After you have entered the group, click the Resolve group button to resolve the group name into a complete Distinguished Name (DN). 8. Click the Finish button. The Edit customer view is displayed again. 9. Click the Save button to save your changes. 7.4 Edit customers 1. In the super administrator customer Dashboard under Customer Management, locate the customer you want to edit. 2. Click the Edit pencil icon next to the required customer. 13

Sophos Mobile Control 3. The Edit customer view is displayed. 4. Make the required changes. 5. Click the Save button. 7.5 Deactivate customers If a customer is no longer used for device management with Sophos Mobile Control, you can deactivate it. 1. In the super administrator customer Dashboard under Customer Management, locate the customer you want to deactivate. 2. Click the Edit pencil icon next to the required customer. 3. The Edit customer view is displayed. 4. Select the Deactivate account field. The customer is deactivated. Users managed in this customer can no longer log in to the Sophos Mobile Control Self Service Portal or the Sophos Mobile Control web console. Devices managed in this customer can still synchronize with the Sophos Mobile Control server. 7.6 Delete customers You can delete customers that have no devices registered with Sophos Mobile Control. 1. In the super administrator customer Dashboard under Customer Management, locate the customer you want to deactivate. 2. Click the Delete icon next to the required customer. Note: This icon is only available, if no devices are registered for the customer. 3. In the message displayed, confirm that you want to delete the customer. The customer is deleted and removed from the customer overview table under Customer management. 7.7 Filter customer list 1. In super administrator Dashboard, click the Filter button (magnifier icon) in the header. The Customer filter dialog is displayed with the status Filter is not active. 14

Super administrator guide 2. In the Customer filter dialog, you can select the following filter options: Option Name Activated Description Filter according to customer name. Select Yes to show only activated customers. Select No to show all inactive customers. 3. After you have selected the required criteria, click Filter. The filter is activated and the list of customers is reloaded. The Filter button in the web console header changes its color from blue to pink to indicate that the filter is active. A Reset button is available in the header for resetting the filter. The status of the device filter in the Customer filter dialog changes to Filter is active. Note: Remember to reset filters manually when they are no longer needed. Otherwise lists or reports may not include the results you expect. 7.8 Export customer list You can export the full customer list or a filtered customer list from the web console. 1. In the super administrator customer Dashboard under Customer management, click the Creates a report of all customers (CSV file) button. A file download dialog is displayed. 2. Click Save to save the export file to the required location. The customer list is exported to a.csv file. It contains all fields visible in the super administrator web console. Note: The customer list takes any filters currently set into consideration. If the list does not contain the expected results, check if the customer filter is set. 15

Sophos Mobile Control 8 Manage configurations, settings and packages As a super administrator you can define configurations and settings in the super administrator customer and apply them to other customers: When you create customers, you can define that Settings and packages that you have defined in the super administrator customer are cloned to new customers. You can create configurations and packages in the super administrator customer and push them to existing customers. Note: Configurations pushed to existing customers cannot be edited or deleted in these customers. For example: An inherited software package cannot be edited or deleted. If administrators have the required rights, they can copy the package and edit it. Inherited software packages that have been added to task bundles can no longer be deleted by the super administrator in the super administrator customer. When you create customers, the existing Default device group is copied to new customers. For information on how to define configurations, settings and device groups, see the Sophos Mobile Control administrator guide. 8.1 Clone configurations, settings and packages to new customers As a super administrator you can define the following configurations, settings and packages in the super administrator customer and clone them to new customers: Device groups SMC client packages Software packages Configurations: Apple ios profiles, Android profiles, Windows Mobile profiles and Windows Mobile profile templates Task bundles Command bundles Backup profiles Settings: Personal settings Self Service Portal settings SMSec settings ios client settings 16

Super administrator guide Provisioning via email settings Password policies settings SSP welcome email settings ios APNS settings RIM BES settings Technical Contact information Compliance settings Note: For information on how to define configurations, settings and packages, see the Sophos Mobile Control administrator guide. 1. Create a new customer (see Create customers (section 7.2)). 2. Under Clone settings, select Settings and packages. 3. Click the blue Save icon. The settings and packages are transferred to the new customer. They can be edited in the new customer. 8.2 Push configurations and packages to existing customers As a super administrator you can define the following configurations and packages in the super administrator customer and push them to existing customers: Sophos Mobile Control client packages Software packages Configurations: Apple ios profiles and Android profiles Task bundles Command bundles Backup configurations Windows Mobile profiles Windows Mobile profile templates Note: For information on how to define configurations and create packages, see the Sophos Mobile Control administrator guide. 1. In the super administrator customer, create the configuration that you want to push. 2. From the Sophos Mobile Control menu bar, select the relevant configuration, for example a task bundle under Tasks - Bundles. The overview table for the selected configuration is displayed. 17

Sophos Mobile Control 3. Click the Edit pencil icon for the relevant configuration. The Edit view for the selected configuration is displayed. 4. Click the Edit button next to the Assigned customers field. The Assigned customers view is displayed. 5. Select the customer(s) the configuration is to be pushed to. 6. Click the blue Apply icon. The configuration is applied to the customer(s) selected. Note: Configurations pushed to existing customers cannot be edited or deleted in these customers. For example: An inherited software package cannot be edited or deleted. If administrators have the required rights, they can copy the package and edit it. Inherited software packages that have been added to task bundles can no longer be deleted by the super administrator in the super administrator customer. 18

Super administrator guide 9 Define customer preselection settings for login to the Self Service Portal With the Self Service Portal you can reduce IT efforts by allowing end users to register their own devices and carry out other tasks without having to contact the helpdesk. In the web console, you can configure settings for the use of the Self Service Portal, for example for which platforms registration through the Self Service Portal should be active or which functions should be available in the Self Service Portal. You can also manage the users of the Self Service Portal. As a super administrator you can preselect the default customer for end users for their login at the Self Service Portal. 1. In the Dashboard view, click the Settings button. The Settings view is displayed. 2. Go to the Self Service Portal tab. 3. Under SSP login customer preselection, select Default customer and select the required costumer from the dropdown list. 4. If you want end users to be able to see the customer and change it when logging on, make sure that the visible and editable checkbox is selected. 5. Click the Save button. 19

Sophos Mobile Control 10 Configure SCEP for ios devices For ios devices, you can configure Simple Certificate Enrollment Protocoll (SCEP) to provide certificates. You thereby allow devices to obtain certificates from a Certificate Authority by using SCEP. SCEP needs to be enabled during Sophos Mobile Control setup. For further information, see the Sophos Mobile Control installation guide. As a super administrator, you can configure all required settings for accessing a Certificate Authority server with SCEP in the web console. You can define the required settings for devices in ios SCEP configurations. For further information, see the Sophos Mobile Control administrator guide. 10.1 Configure SCEP settings Context for the current task 1. In the Dashboard view, click the Settings button. The Settings view is displayed. 2. Go to the SCEP tab. 3. Specify the following: SCEP Server URL Challenge URL In the Password field, enter a password for obtaining certificates. In the Challenge length field, enter the required length of the challenge for obtaining certificates. 4. Click the Save button. 20

Super administrator guide 11 Export a device report for all customers As a super administrator, you can export a list of all managed devices for all customers 1. In the super administrator customer Dashboard, click the Creates a report of all customer devices (CSV file) button. A file download dialog is displayed. 2. Click Save to save the export file to the required location. 21

Sophos Mobile Control 12 Download log files As a super administrator, you can download all log files from the server in a.zip file. The.zip file contains all log files of the past five days. 1. In the super administrator customer Dashboard, click the Download log files (ZIP file) button. A file download dialog is displayed. 2. Click Save to save the.zip file to the required location. 22

Super administrator guide 13 Create new super administrators 1. In the super administrator customer Dashboard, click the User management button. The Show users view is displayed. 2. Click the Create new user button. The Edit user view is displayed. 3. Enter a Login name for the new user. 4. In the Role field, select Administrator. 5. Enter the Last name and the First name of the new user. 6. Enter the Email address of the new user. 7. Enter a one-time Password for the first login at the web console and confirm it. 8. Click the Save button. The new user is created and shown in the Show users view. Forward the user credentials (user, customer and one-time password) to the new user. The new user can log in at the web console with them and is prompted to change the password. 23

Sophos Mobile Control 14 Technical support You can find technical support for Sophos products in any of these ways: Visit the SophosTalk community at http://community.sophos.com/ and search for other users who are experiencing the same problem. Visit the Sophos support knowledgebase at http://www.sophos.com/en-us/support.aspx. Download the product documentation at http://www.sophos.com/en-us/support/documentation.aspx. Send an email to support@sophos.com, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages. 24

Super administrator guide 15 Legal notices Copyright 2011-2013 Sophos Ltd. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner. Sophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners. 25