Service Description: Insert Title Enterprise Mobility as a Service Multi-Service User Management for Mobility 1. Executive Summary... 2 2. Enterprise Mobility as a Service Overview... 3 3. Pricing Structure... 14 Page 1 of 6
1. Executive Summary Mobility management continues to be amongst the top issues for organizations. Enterprise customers face a common set of business challenges centered on : Ease of use of new services IT & security administration Controlling the cost of doing business Generating a positive return on investment in mobile technologies Enabling employees to bring their own devices into the work-place Key concerns enterprises seek to address are fast deployment, better user adoption and reduced inhouse support needs. In many cases, these challenges can be solved by procuring point solutions which address each of these individually, but leaves the customer with a mix-match of different services and technologies, adding to the overall burden on the IT organization. Verizon Enterprise Mobility as a Service (EMaaS) provides a cloud based multi-service user management solution that enables the enterprise to manage employee s access to business mobility services securely and cost effectively. This is accomplished seamlessly through a single pane of glass management portal, the Enterprise Mobility Management Center (EMMC), which enables the enterprise administrator to manage multiple mobility services on a user basis and agnostic to the type of device. Through the EMMC, customers can select which features of the service are deployed to each user; fine-tuning the service and removing the need to deploy unnecessary functionality to all users. As a result, EMaaS enables all the front end functionality of mobility management, without any of the backend difficulties associated with such a feature-rich service. Core functionality of EMaaS includes: User Management Device Management Access Management Divide for Enterprise Mobility as a Service Security Management Professional Services are available as an option for an Enterprise Mobility as a Service customer. These are intended to accelerate the design and deployment of the solution in their environment. Based on a pre-defined scope and set of objectives, Verizon Consultants will define and configure Enterprise Mobility as a Service for the customer making ready for enterprise deployment. Page 2 of 6
2. Enterprise Mobility as a Service Overview Through the combination of state of the art technologies and robust systems, Verizon s Enterprise Mobility as a Service solution helps manage the cost and reduce the complexity of deploying, managing and securing mobile devices. Enterprise Mobility as a Service addresses the need of the customer to control costs and deals with complexity by verifying that corporate policies are applied, devices are managed and controlled on as well as off the corporate network. In addition it includes an integrated Divide feature targeted at companies wishing to deploy an Employee Owned Device solution. Verizon s Enterprise Mobility as a Service solution has been designed to address the challenges which many large global enterprises face with managing mobility services for their users. The EMaaS platform supports a number of critical use case including the following: Applying corporate policies on Smartphones, Tablets, Laptops, Netbooks and desktops consistently across device platforms Managing and controlling company owned devices on or remote from the corporate network Managing personal liable device so that they meet minimum standards before an employee can connect to the corporate network Providing a secure container on mobile devices through which customers can deploy corporate policies, settings and application to personal liable devices Moving to a cloud based management system to reduce the total cost of ownership, as simple monthly fees replace expensive capital intensive deployments Access Management feature to reduce the network costs of mobile devices by off-loading them onto preferred Wi-Fi networks (public hotspots and/or corporate WLAN) By providing customers with the tools to easily manage their devices Verizon Enterprise Mobility as a Service allows customers to focus on their core business. Page 3 of 6
Enterprise Mobility as a Service is a platform which helps control costs and deal with complexity. Key Benefits of the service are: Ease of Management- manage the service through a network based management platform and user based management framework to facilitate consistent service utilization across a user s multiple devices Software as a Service (SAAS) model requiring no up-front hardware or software installations and monthly fees replace capital deployments, helping manage your total cost of ownership Ease of Use- simplify the experience of your users through Verizon s intuitive Enterprise Connect (EC) client software Reduce complexity by consistently applying corporate policies across multiple device types (smartphones, tablets, laptops and desktops) Seamless integrated security Carrier agnostic solution Simplify remote access to business critical systems Streamlines maintenance costs & operations 2.1 Enterprise Mobility Management Center As part of Verizon s business solutions, the Enterprise Mobility as a Service offering helps create and manage mobile services within the customer s IT environment. The EMMC is a powerful multi-tenant platform hosted in Verizon s Datacenters. Through its secure web based portal, customers are able to manage their Enterprise Mobility as a Service implementation from end to end. The portal has a powerful capacity to allow administrators to assign an almost limitless combination of tools to any group of users. Most privileges can be assigned as read/write or read only. This allows for a powerful customization of responsibilities across a large, global organization. As a result, the menu choices that are available to each user reflect the privileges which have been assigned to that user. Each and every feature privilege in the EMMC can be configured to meet the needs specific to the role required. Page 4 of 6
The functionality available to administrators is grouped into menus visible on the EMMC web page. Menu My Account Users & Groups Mobile Device Management Customer Reports Network Policy Directories VPN Gateways Client Settings Software Distribution End Point Security Administration Description Displays information Set up user groups, profile mapping and users Define policies and settings to be applied to mobile devices Contains all reporting information Controls the access to the Verizon networks. Create additional network directories for devices Configure VPN gateway & authentication settings Define settings to be applied to the Windows application (laptops) Create and assign packages to be deployed to all device types Define security settings to be applied to Windows devices (laptops) Bulk load users and devices as well as carry out other administrative tasks 2.2 User Management Enterprise Mobility as a Service provides a unique means to manage mobility services on a per user basis as opposed to a per device / service basis. Users can be assigned to multiple groups in the EMMC Policies and settings are assigned to individual or multiple groups Single users can enroll multiple devices under a single profile Single users can have a mix of corporate and personal devices, but managed with a different set of policies User Profile Mapping Page 5 of 6
Multiple user enrollment options are available to customers: Menu Via Admin Portal Self-Registration Bulk-Load to Portal Integration with Customer Database Description Manually create users on the portal Enable users to self-enroll on the portal Create user profiles off-line and load into portal Utilize existing database (i.e. Active Directory) via radius proxy authentication. Once a user profile is created, users are able to enroll their devices into the service through the EMMC portal. 2.3 Access Management Mobile devices operate on the premise of always-on connectivity via 3G & 4G mobile data networks. While this ensures users are always able to access the data they need when they want, there are situations where it may make sense for their devices to be connected to a Wi-Fi network instead of continuing to use the Mobile network primarily to limit exposure to data plan overages and data roaming utilization. The Access Management feature of Enterprise Mobility as a Service, provides the capabilities for customers to manage and control when their devices can off-load to a preferred Wi-Fi network. The Directories section of the EMMC can be used to create directories of Corporate Wi-Fi locations which can then be deployed to the devices. Each Directory can contain multiple locations, as well as be deployed to all or groups of users. When a Directory is deployed to a user, it is applied across the entire range of devices which that user has enrolled. Page 6 of 6
For example, a customer can define all their Wireless LAN settings in their facilities around the world. Users travelling between each facility would see their device auto-connect to the Wireless LAN without any user intervention. In such a situation, user s devices are using a free Wi-Fi network in their company s facility instead of expensive data roaming potentially saving a significant amount of money. Within the functionality of the service, Verizon provides access to a footprint of over 500,000 hotspots in over 90 countries around the world. These are located in airports, hotels and many other venues. Device managed through Enterprise Mobility as a Service will be automatically connected and authenticated to these hotspots. Depending on a customer s price plan and where this is used, using these Wi-Fi hotspots may generate additional billing items on their invoice; to reduce this, administrators have the ability to un-assign Verizon Wi-Fi from a user s profile. Page 7 of 6
2.4 Divide for Enterprise Mobility as a Service The Divide for Enterprise Mobility as a Service feature enables and accelerates employee owned device mobility by providing a separate and secure work environment, which IT can cloud- manage without compromising an employee s privacy. Divide provides IT with access to a full set of remote management capabilities to monitor and manage a fleet of mobile devices without requiring the installation of any desktop or server software. For IT administrators, the Divide platform provides: A cloud- based turn- key platform that enables enterprise- grade security without storing any proprietary or business- related data on employee owned mobile devices. A remote management console that enables management of all connected devices including enforcing policies, remotely wiping corporate data, locking the corporate profile and enforcing password resets. An advanced device client that deploys to any Android 2.2+ or ios 5+ smartphone or tablet, Key Advantages: Provide Total Enterprise Security The Divide platform supports full data encryption, while also protecting the enterprise from unauthorized access and malware. The Divide platform provides device management and the ability to protect against data leakage and remotely wipe corporate data. Support for Any Device The Divide platform can be utilized on any employee owned smartphone or tablet on Android and ios across any mobile service provider while reducing the complexity IT administrators experience in provisioning and maintaining personal liable devices. The result is enabling a fast Employee Owned device implementation. Page 8 of 6
Supported Features: Device Security Encrypted application databases Screenlock enforcement Remote device wipe (corporate data only) Enterprise data inaccessible to personal applications Device timebomb (passive wipe) Copy/paste restrictions Data leakage prevention Anti-- tamper (root and debugger) support Customizable remote wipe policies Enterprise Apps Mail / Calendar / Contacts Dialer / Messenger / Tasks Cloud file- storage integration (Box) Developer SDK Application deployment Mobile Device Management Remote policy push and enforcement Touchless over- the- air configuration Multiple devices per user Secure enterprise application management Multiple admins with configurable roles Roaming management Corporate branding Divide Security: Data held in the work persona is protected at all times. The default configuration ensures that data in the work persona is not accessible at any time from the personal persona and is protected in the event of a security attack or lost or stolen device. The following data protection security policies are in effect by default. Disable Copy/Paste clipboard between personas. Disable file traversal in media/document helper applications. Disable file traversal in for email attachments. Wipe device on SIM Card change. Wipe device on password failures. Wipe device remotely. These policies are designed to protect the Data on the device without impairing functionality. Divide encrypts the sensitive data held in the mail, calendar and contact with AES 256 bit encryption. In the event that a device is lost, it is possible to remotely wipe the work persona from the Divide Manager Management console. If the device is not contactable over the air, the work persona will wipe itself after 10 failed password attempts or if a new SIM card is detected in the phone. The number of failures can be configured. Page 9 of 6
2.5 Mobile Device Management Enterprise Mobility as a Service includes advanced Mobile Device Management (MDM) features for Apple IOS (iphone and ipad) and Google Android (smartphones and tablets) devices, additional functionality is available for Samsung Approved For Enterprise (SAFE) devices. MDM enables customers to secure, monitor, manage and support their mobile devices deployed across multiple mobile operators, service providers and geographies. When deployed, MDM can control and protect data and configuration settings for all mobile devices, whether they are corporate or personal owned. Enterprise Mobility as a Service provides the flexibility to build and deploy devices which can apply irrespective of device ownership or separate by device ownership. Additionally, as with all functionality of the service, different groups of users can have different MDM profiles assigned to them and these can be ranked to avoid any policy conflicts. Mobile Device Management features at a glance: Enforce Password policy Impose restrictions on devices Configure e-mail & VPN Deploy Applications (including use of Apple VPP Licenses) Create application catalogue Lock, locate, wipe device Compliance reporting MDM Installation App Catalogue 2.6 Security Management Through the combination of the different features available through Enterprise Mobility as a Service, customers are able to effectively manage the security of their devices.. Specifically configurations can be deployed to enforce password policies on mobile devices, wipe lost or stolen mobile devices, secure corporate data within the Divide container, force VPN connections for remote laptops. Not only can Enterprise Mobility as a Service help to prevent security breaches, but through the reporting capabilities, it is possible to check for device compliance, identify new possible rogue software, which can all be followed up appropriate policies to mitigate any risk from these. Divide for Enterprise Mobility as a Service (Android and IOS) Employees are demanding more and more that their IT department support the devices they want to use. Employees also prefer to carry one device in their pocket; one that can be used for both business and personal. Businesses must allow for device flexibility while at the time investing in the platforms to Page 10 of 6
address the security and management challenges presented by employees bringing their mobile devices into work. Divide addresses the primary security and management concerns of enterprise customers and administrators through the use of application, data and device level security management. The Divide container is a fully encrypted workspace deployed to the employee s mobile device where business apps and data are managed separately from personal apps and data. Polices are applied to just the secure business container leaving the personal side of the device untouched by the enterprise. There are safeguards in place to prevent any crossing over between the personal and business side. For example, malware that an employee downloads to the personal side of the device is prevented from accessing data in the secure business container. Additionally, policies can be set to prevent an employee from copying or forwarding corporate data from the business side to the personal side of the device (which is commonly known as data leakage). Divide also provides a mechanism to securely distribute custom business apps that can only run from within the secure container. Destination Management (Windows Only) Customers may want to allow their employees to access the Internet while they are not connected to the corporate Network. On the other hand, some customers always want to manage all Internet access through their firewall and other security applications in their Intranet. The Destination Management feature allows Enterprises to manage their employee s access to the network. With this feature, end users can be provided unrestricted access to the Internet or time & security policy restricted access to the Internet governed by a grace period setting which the Enterprise administrator can define in the Enterprise Mobility Management Center. After the grace period expires, the end user has to connect to a VPN or will no longer have access to the Internet from their device. Enterprise administrators can also define so called white listed sites which the employee can freely access from their device and also block sites that may not be accessed. White listed sites can allow employee to access a business crucial application (like email) or read the latest industry news. Blocked sites may consist of sites that are deemed to not be appropriate by the company s internal code of conduct policies. Endpoint Security (Windows Only) Customers may want to ensure that their employee s devices are in compliance with corporate security policies. The Endpoint Security feature provides the Enterprise administrator with tools to ensure that employee devices have the necessary software applications (ex: anti-virus, firewall, anti-malware, etc.) installed and running on their device before connecting to the Internet. Based on policy settings in the EMMC, the platform will either disconnect the user's device when not in compliance or warn the end user and remediate the device immediately. Endpoint Security is supported on desktops, laptops, netbooks and tablets running Microsoft Windows Vista, Windows XP and Windows 7. Page 11 of 6
2.7 Reporting A number of reports are available to customers through the EMMC. All reports are generated in realtime and reflect the last known information available. The reporting section is located in the Customer Reporting menu on the portal. Individual reports can be allocated to specific groups. Customer administrators have the option to view the reports on-line or download these for off-line viewing in Microsoft Excel or Microsoft Word formats. Enterprise Mobility as a Service Report Description Report Title Apple VPP Licenses Census Drill Down Census For User Client Check-ins for Customer Customer Provisioning Device Application Compliance Device Applications Device Locations Map Device Ownership Distribution Device Platform Distribution License Count For Customer Network Usage by Directory Policy Logs Privileges for User Search Devices Search Sessions Unassigned Resources Description Shows the number of uploaded Apple Volume Purchasing Program licenses and the number redeemed. Drill down on user population Windows system census information, including hardware and software snapshots. Census data for one user, chosen by an administrator. This report shows the last Windows client check-in date and time for each user, including the last known client IP address. View basic customer information, including all assigned provisions Shows the number of mobile devices where all mandatory applications are or are not installed Device Applications per Customer A map showing the last known locations for all devices. View a distribution of device ownership types View a distribution of device platforms Displays a license count for the current company up to and including the month entered. Also displays a count of users deactivated in the month entered. Pie chart and table for network connection usage by directory. Customer Policy Logs List of portal privileges for user Search Device Properties Search for ISP and VPN session by group and other session properties. View company provisions that are not assigned to any group. Page 12 of 6
User Count by Group User Device Registration Distribution User Provisioning User Sessions VPN Gateway Usage by Date A count of all users in all groups of the customer. Shows the number of users with registered devices, unregistered devices or no devices. Portal provisions assigned to the current user VPN and ISP connect sessions summarized by month, and month details. Gateway user usage by month. Page 13 of 6
3. Pricing Structure Enterprise Mobility as a Service pricing is based on the number of active users of a customer each month (with a minimum of 25 users), this includes access to all the features available in the portal. Additional charges may be incurred when/if users connect to Verizon Wi-Fi and Dial networks (depending on location) In addition, the service is charged on a truly SAAS (Software as a Service) model, as customers on or off board their users to the service, the billing adjusts automatically. Example: Customer orders EMaaS at $8.95 per user with intention of rolling out to 1,000 users Month 1: Min 25 Users = $223.75 Month 2: 50 Users = $467.50 Month 3: 600 users = $5,370 Month 4: 1,000 users = $8,950 Month 5: 800 users = $7,160 (result of divestiture of a 200 employee division) Page 14 of 6