The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuration and Management

This Help section is intended for specialists who administer Kaspersky Secure Mobility Management, as well as for specialists who provide technical support to organizations that use Kaspersky Secure Mobility Management.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Getting Started

This section describes the actions that you are recommended to perform when getting started with Kaspersky Secure Mobility Management.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Starting and stopping the application

Kaspersky Security Center automatically starts and stops administration plug-ins of Kaspersky Endpoint Security for Android and Kaspersky Device Management for iOS.

Kaspersky Endpoint Security for Android launches when the operating system starts up and protects the mobile device during the entire session. The user can stop the app by disabling all Kaspersky Endpoint Security for Android components. You can use group policies to configure user permissions to manage app components.

On certain devices (for example, HUAWEI, Meizu, and Xiaomi), you must manually add Kaspersky Endpoint Security for Android to the list of apps that are started when the operating system starts (Security → Permissions → Autorun). If the app is not added to the list, Kaspersky Endpoint Security for Android stops performing all of its functions after the mobile device is restarted.

You must also disable Battery Saver mode for Kaspersky Endpoint Security for Android. This is necessary for the app to run in the background, such as running a scheduled malware scan or synchronizing the device with Kaspersky Security Center. This issue is attributable to the specific features of the embedded software of these devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Creating an administration group

To perform centralized configuration of the Kaspersky Endpoint Security for Android app installed on the users' mobile devices, the group policies must be applied to the devices.

To apply the policy to a device group, you are advised to create a separate group for these devices in the Managed devices prior to installing mobile apps on user devices.

After creating an administration group, it is recommended to configure the option to automatically allocate devices on which you want to install the apps to this group. Then configure settings that are common to all devices using a group policy.

To create administration group, follow the steps below:

1. In the console tree, select the Managed devices folder.
2. In the workspace of the Managed devices folder or subfolder, select the Devices tab.
3. Click the New group  button.

   This opens the window in which you can create a new group.

4. In the Group name window type the group name and click OK.

A new administration group folder with the specified name appears in the console tree. For more detailed information on use of administration groups, see Kaspersky Security Center Help.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Group policies for managing mobile devices

A group policy is a package of settings for managing mobile devices that belong to an administration group and for managing mobile apps installed on the devices. You can create a group policy using the Policy Wizard.

You can use a policy to configure settings of both individual devices and a group of devices. For a group of devices, administration settings can be configured in the window of group policy properties. For an individual device, they can be configured in the window of local application settings. Individual management settings specified for one device may differ from the values of settings configured in the policy for a group to which this device belongs.

Each parameter represented in a policy has a "lock" attribute, which shows whether the setting is allowed for modification in the policies of nested hierarchy levels (for nested groups and secondary Administration Servers), in local application settings.

The values of settings configured in the policy and in local application settings are saved on the Administration Server, distributed to mobile devices during synchronization, and saved to devices as current settings. If the user has specified other values of settings that have not been "locked", during the next synchronization of the device with the Administration Server the new values of settings are relayed to the Administration Server and saved in the local settings of the application instead of the values that had been previously specified by the administrator.

To keep corporate security of mobile devices up to date, you can monitor users' devices for compliance with the group management policy.

The security level indicator is displayed in the upper part of the group policy window. The security level indicator will help you configure the policy so as to ensure a high level of device protection. The protection level indicator status changes depending on the policy settings:

• High protection level – an appropriate level of device protection is provided. All protection components function according to the settings recommended by Kaspersky.
• Medium protection level – the protection level is lower than recommended. Some critical protection components are disabled (for example, Web Protection). Important issues are marked with the icon.
• Low protection level – there are problems that may lead to infection of the device and loss of data. Some critical protection components are disabled (for example, real-time protection of devices is disabled). Critical issues are marked with the icon.

For more details on managing policies and administration groups in the Administration Console of Kaspersky Security Center, please refer to Kaspersky Security Center Help.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Creating a group policy

This section describes the process of creating group policies for devices on which Kaspersky Endpoint Security for Android mobile app are installed and policies for iOS MDM devices.

Policies created for an administration group are shown in the group workspace in the Administration Console of Kaspersky Security Center on the Policies tab. The icon indicating the policy status (active / inactive) appears before the policy name. Several policies for different apps can be created in one group. Only one policy for each app can be active. When a new active policy is created, the previous active policy becomes inactive.

You can modify a policy after it is created.

To a policy for managing mobile devices:

1. From the console tree, select an administration group for which you want to create a policy.
2. In the workspace of the group, select the Policies tab.
3. Click the New policy link to start the Policy Wizard.

This starts the Policy Wizard.

Step 1. Choose an application for creating a group policy

At this step, select the application for which you want to create a group policy in the list of applications:

• Kaspersky Endpoint Security for Android – for devices using the Kaspersky Endpoint Security for Android mobile app.

It is recommended to create a separate policy for HUAWEI and Honor devices that do not have Google play services. This way you can send links to HUAWEI AppGallery to the users of all such devices.

• Kaspersky Device Management for iOS – for iOS MDM devices.

A policy for mobile devices can be created if the Kaspersky Endpoint Security for Android Administration Plug-in and the Kaspersky Device Management for iOS Administration Plug-in are installed on the administrator's desktop. If the plug-ins are not installed, the name of the relevant application does not appear in the list of applications.

Proceed to the next step of the Policy Wizard.

Step 2. Enter a group policy name

At this step, type the name for the new policy in the Name field. If you specify the name of an existing policy, it will have (1) added at the end automatically.

Proceed to the next step of the Policy Wizard.

Step 3. Create a group policy for the application

At this step, the Wizard prompts you to select the status of the policy:

• Active policy. The Wizard saves the created policy on the Administration Server. At the next synchronization of the mobile device with the Administration Server, the policy will be used on the device as the active policy.
• Inactive policy. The Wizard saves the created policy on the Administration Server as a backup policy. This policy can be activated in the future after a specific event. If necessary, an inactive policy can be switched to active state.

  Several policies can be created for one application in the group, but only one of them can be active. When a new active policy is created, the previous active policy automatically becomes inactive.

Exit the Wizard.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring synchronization settings

To manage mobile devices and receive reports or statistics from mobile devices of users, you must configure the synchronization settings. Mobile device synchronization with Kaspersky Security Center may be performed in the following ways:

• By schedule. Synchronization by schedule is performed by using the HTTP protocol. You can configure the synchronization schedule in the group policy settings. Modifications to group policy settings, commands and tasks will be performed when the device is synchronizing with Kaspersky Security Center according to the schedule, i.e. with a delay. By default, mobile devices are synchronized with the Kaspersky Security Center automatically every 6 hours.
• Forced. Forced synchronization is performed by using push notifications of the FCM service (Firebase Cloud Messaging). Forced synchronization is primarily intended for timely delivery of commands to a mobile device. It might be useful when a device is in battery saver mode, because in this case the app may perform tasks later than specified. If you want to use forced synchronization, make sure that the FCM settings are configured in Kaspersky Security Center.

To configure the settings of mobile device synchronization with the Kaspersky Security Center:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Synchronization section.
5. Select the frequency of synchronization in the Synchronize drop-down list.
6. To disable synchronization of a device with Kaspersky Security Center while roaming, select the Do not synchronize while roaming check box.

   The device user can manually perform synchronization in the app settings ( → Settings → Synchronization → Synchronize).

7. To hide synchronization settings (server address, port and administration group) from the user in the app settings, clear the Show synchronization settings on device check box. It is impossible to modify hidden settings.
8. To receive the device's location history, select the Send device location history during synchronization check box in the Device location history block. The location history will be sent to the Administration Server during each synchronization.

   The functionality must be used in accordance with the requirements of local legislation, with the notification or consent (depending on the requirements of the legislation) of the person using the device to enable the location tracking functionality on the device.

   Enabling this setting and specifying the geofence area will result in increased device power consumption.
   
   This setting works only if the Device location history informational event type is stored in the Administration Server database. The events are configured in the Events section of the policy properties. For more details, please refer to the Kaspersky Security Center Help.

9. In the How often to get the device location drop-down list, specify the frequency of getting the device location. The default value is Every 15 minutes.

   Due to technical limitations on Android devices, the device location may be retrieved less often than specified.

10. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. You can manually synchronize the mobile device by using a special command. To learn more about working with commands for mobile devices, please refer to the "Sending commands" section.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Managing revisions to group policies

Kaspersky Security Center lets you track group policy modifications. Every time you save changes made to a group policy, a revision is created. Each revision has a number.

You can manage revisions only for Kaspersky Endpoint Security for Android policies. You cannot manage revisions for a Kaspersky Device Management for iOS policy.

You can perform the following actions on group policy revisions:

• Compare a selected revision to the current one.
• Compare selected revisions.
• Compare a policy with a selected revision of another policy.
• View a selected revision.
• Roll back policy changes to a selected revision.
• Save revisions as a .txt file.

For more details about managing revisions of group policies and other objects (for example, user accounts), please refer to Kaspersky Security Center Help.

To view the history of group policy revisions:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Revision history section.

   A list of policy revisions is displayed. It contains the following information:

   • Policy revision number.
   • Date and time the policy was modified.
   • Name of the user who modified the policy.
   • Action performed on the policy.
   • Description of the revision made to policy settings.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Removing a group policy

To remove a group policy:

1. In the console tree, select an administration group for which you want to remove a policy.
2. In the workspace of the administration group on the Policies tab select the policy you want to remove.
3. In the context menu of the policy, select Delete.

As a result, the group policy is deleted. Before the new group policy is applied, mobile devices belonging to the administration group continue to work with the settings specified in the policy that has been deleted.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Restricting permissions to configure group policies

Kaspersky Security Center administrators can configure the access permissions of Administration Console users for different functions of the Kaspersky Secure Mobility Management integrated solution depending on the job duties of users.

In the Administration Console interface, you can configure access rights in the Administration Server properties window on the Security and User roles tabs. The User roles tab lets you add standard user roles with a predefined set of rights. The Security section lets you configure rights for one user or a group of users or assign roles to one user or a group of users. User rights for each application are configured according to functional scopes.

You can also configure user permissions specific to functional areas. Information about the correspondence between functional areas and policy tabs is given in Annex.

For each functional area, the administrator can assign the following permissions:

• Allow editing. The Administration Console user is allowed to change the policy settings in the properties window.
• Block editing. The Administration Console user is prohibited from changing the policy settings in the properties window. Policy tabs belonging to the functional scope for which this right has been assigned are not displayed in the interface.

For more details on managing user rights and roles in the Administration Console of Kaspersky Security Center, please refer to Kaspersky Security Center Help.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Control

This section contains information about how to remotely monitor mobile devices in the Administration Console of Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring restrictions

This section provides instructions on how to configure user access to the features of mobile devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Special considerations for devices running Android 10 or later

Android 10 introduced numerous changes and restrictions targeting API 29 or higher. Some of these changes affect the availability or functionality of some of the app's features. These considerations apply only to devices running Android 10 or later.

Ability to enable, disable, and configure Wi-Fi

• Wi-Fi networks can be added, deleted, and configured in the Administration Console of Kaspersky Security Center. When a Wi-Fi network is added to a policy, Kaspersky Endpoint Security receives this network configuration when it first connects to Kaspersky Security Center.
• When a device detects a network configured through Kaspersky Security Center, Kaspersky Endpoint Security prompts the user to connect to that network. If the user chooses to connect to the network, all of the settings configured through Kaspersky Security Center are automatically applied. The device then automatically connects to that network when in range, without showing further notifications to the user.
• If a user's device is already connected to another Wi-Fi network, sometimes the user may not be prompted to approve a network addition. In such cases, the user must turn Wi-Fi off and on again to receive the suggestion.
• When Kaspersky Endpoint Security suggests a user connect to a Wi-Fi network and the user refuses to do so, the app's permission to change the Wi-Fi state is revoked. Kaspersky Endpoint Security then cannot suggest connecting to Wi-Fi networks until the user grants the permission again by going to Settings → Apps & notifications → Special App access → Wi-Fi Control → Kaspersky Endpoint Security.
• Only open networks and networks encrypted with WPA2-PSK are supported. WEP and WPA encryption are not supported.
• If the password for a network previously suggested by the app is changed, the user must manually delete that network from the list of known networks. The device will then be able to receive a network suggestion from Kaspersky Endpoint Security and connect to it.
• When a device OS is updated from Android 9 or earlier to Android 10 or later, and/or Kaspersky Endpoint Security installed on a device running Android 10 or later is updated, the networks that were previously added via Kaspersky Security Center cannot be modified or deleted through Kaspersky Security Center policies. The user, however, can manually modify or delete such networks in the device settings.
• On devices running Android 10, a user is prompted for the password during an attempt to connect manually to a protected suggested network. Automatic connection does not require entering the password. If a user's device is connected to some other Wi-Fi network, the user must first disconnect from that network to connect automatically to one of the suggested networks.
• On devices running Android 11, a user may manually connect to a protected network suggested by the app, without entering the password.
• When Kaspersky Endpoint Security is removed from a device, the networks previously suggested by the app are ignored.
• Prohibiting use of Wi-Fi networks is not supported.

Camera access

• On devices running Android 10, use of the camera cannot be completely prohibited. Prohibiting use of the camera for a work profile is still available.
• If a third-party app attempts to access the device's camera, that app will be blocked, and the user will be notified about the issue. However, the apps that use the camera while running in background mode cannot be blocked.
• When an external camera is disconnected from a device, a notification about the camera not being available may be displayed in some cases.

Managing screen unlock methods

• Kaspersky Endpoint Security now resolves the password strength requirements into one of the system values: medium or high.
  • If the password length required is 1 to 4 symbols, then the app prompts the user to set a medium-strength password. It must be either numeric (PIN), with no repeating or ordered (e.g. 1234) sequences; or alphanumeric. The PIN or password must be at least 4 characters long.
  • If the password length required is 5 or more symbols, then the app prompts the user to set a high-strength password. It must be either numeric (PIN), with no repeating or ordered sequences; or alphanumeric (password). The PIN must be at least 8 digits long; the password must be at least 6 characters long.
• Using a fingerprint to unlock the screen can be managed for a work profile only.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring restrictions for Android devices

To keep an Android device secure, configure the Wi-Fi, camera, and Bluetooth usage settings on the device.

By default, the user can use Wi-Fi, camera, and Bluetooth on the device without restrictions.

To configure the Wi-Fi, camera, and Bluetooth usage restrictions on the device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device Management section.
5. In the Restrictions section, configure usage of Wi-Fi, camera, and Bluetooth:
   • To disable the Wi-Fi module on the user's mobile device, select the Prohibit use of Wi-Fi check box.

     On devices running Android 10 or later, prohibiting the use of Wi-Fi networks is not supported.

   • To disable the camera on the user's mobile device, select the Prohibit use of camera check box.

     When camera usage is prohibited, the app displays a notification upon opening and then closes shortly after. On Asus and OnePlus devices, the notification is shown in full screen. The device user can tap the Close button to exit the app.

     On devices running Android 11 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time. If this is the case, you will not be able to restrict use of the camera.

   • To disable Bluetooth on the user's mobile device, select the Prohibit use of Bluetooth check box.

     On Android 12 or later, the use of Bluetooth can be disabled only if the device user granted the Nearby Bluetooth devices permission. The user can grant this permission during the Initial Configuration Wizard or at a later time.

     On personal devices running Android 13 or later, the use of Bluetooth cannot be disabled.

6. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring iOS MDM device feature restrictions

Expand all | Collapse all

To ensure compliance with corporate security requirements, configure restrictions on the operation of the iOS MDM device. For information about available restrictions, refer to the context help of the administration plug-in.

To configure iOS MDM device feature restrictions:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Features Restriction section.
5. In the Features restriction settings section, select the Apply settings on device check box.
6. Configure iOS MDM device feature restrictions.

   List of feature restrictions

   Delay software updates, in days (supervised only, iOS 11.3+)

   Allows delaying operating system updates on the device.

   If the check box is selected, the user can't access updates for the specified period. The default delay is 30 days. You can specify another period in the Specify the number of days from 1 to 90 field.

   If the check box is cleared, the user can update the software as soon as updates are available.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Specify the number of days from 1 to 90

   Specifies the number of days to delay software updates. The default value is 30 days.

   This option is available if the Delay software updates, in days check box is selected.

   Allow use of camera

   Usage of the camera on the user's mobile device.

   If the check box is selected, the user is allowed to use the device camera.

   If the check box is cleared, the user device camera is disabled. The user cannot take photos, record videos, or use the FaceTime app. The camera icon on the device home screen is hidden.

   This check box is selected by default.

   Allow FaceTime (supervised only)

   Usage of the FaceTime app on the user's mobile device. This check box is available if the use of the device camera is allowed. This setting is available if the Allow use of camera check box is selected.

   If the check box is selected, the user can make and receive calls using FaceTime.

   If the check box is cleared, the FaceTime app is disabled on the user device. The user cannot make or receive video calls.

   This check box is selected by default.

   Allow screenshots and videos

   Capability to take a screenshot or video from the screen of the iOS MDM device.

   If the check box is selected, the user can take and save screenshots and videos from the screen of the mobile device.

   If the check box is cleared, the user cannot take and save screenshots and videos from the screen of the mobile device.

   This check box is selected by default.

   Allow screen observation by Classroom (supervised only)

   Capability for an instructor to view students' iPad screens using the Classroom application. For more details about the Classroom application, please visit the Apple Technical Support website.

   If the check box is selected, the instructor can view students' iPad screens in the Classroom application.

   If the check box is cleared, the instructor cannot view students' iPad screens in the Classroom application.

   This check box is selected by default.

   Allow modification of Personal Hotspot settings (supervised only, iOS 12.2+)

   If the check box is selected, the device user can modify Personal Hotspot settings.

   If the check box is cleared, the device user can't modify Personal Hotspot settings.

   The setting is available for mobile devices running iOS version 12.2 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow access to USB devices in Files app (supervised only, iOS 13.1+)

   If the check box is selected, the user can access connected USB devices in the Files app.

   If the check box is cleared, access to connected USB devices in the Files app is blocked.

   The setting is available for mobile devices running iOS version 13.1 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Enable USB Restricted Mode while device is locked (supervised only, iOS 11.4.1+)

   Specifies whether USB Restricted Mode is enabled when the device is locked.

   If the check box is selected, when locked, the device connection to USB drives is limited via USB Restricted Mode.

   If the check box is cleared, the device is allowed to connect to USB drives when locked.

   The setting is available for mobile devices running iOS version 11.4.1 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Force Wi-Fi on (supervised only, iOS 13.0+)

   Specifies whether Wi-Fi on the managed device should be always on. The device can connect to any Wi-Fi network.

   If the check box is selected, Wi-Fi on the device is always on, even in flight mode. The user can't disable Wi-Fi in the device settings.

   If the check box is cleared, the user can disable Wi-Fi in the device settings.

   The setting is available for mobile devices running iOS version 13.0 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Force connection to allowed Wi-Fi networks only (supervised only, iOS 14.5+)

   Specifies whether the device can connect to allowed Wi-Fi networks only. This option is available if you add at least one Wi-Fi network to the list of Wi-Fi networks in the Wi-Fi section.

   If the check box is selected, the device connects to allowed Wi-Fi networks only. The user can't disable Wi-Fi in the device settings.

   If the check box is cleared, the user can connect to any Wi-Fi network.

   The setting is available for mobile devices running iOS version 14.5 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Allow creating VPN configurations (supervised only, iOS 11+)

   If the check box is selected, the user can create a VPN configuration on the managed device.

   If the check box is cleared, the user can't create a VPN configuration on the managed device.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow AirDrop (supervised only)

   Use of the AirDrop feature for transmitting user data from the iOS MDM device to other Apple devices.

   If the check box is selected, the user can use AirDrop to transmit data to other Apple devices.

   If the check box is cleared, the user cannot transmit data to other Apple devices using AirDrop.

   This check box is selected by default.

   Allow modification of eSIM settings (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can change settings related to the carrier plan.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow iMessage (supervised only)

   Usage of the iMessage service on the user's mobile device.

   If the check box is selected, the user can send and receive messages using the iMessage service.

   If the check box is cleared, the iMessage is not available on the mobile device. The user cannot send or receive messages via iMessage.

   This check box is selected by default.

   Allow Apple Music (supervised only)

   Listening to music on the user's mobile device using the Apple Music service.

   If the check box is selected, the user can listen to music on the mobile device in the Music app.

   If the check box is cleared, the Apple Music service is not available to the user.

   This check box is selected by default.

   Allow Radio in Apple Music (supervised only)

   Listening to the radio using the Apple Music service on the user's mobile device.

   If the check box is selected, the user can listen to the radio in the Music app on the mobile device.

   If the check box is cleared, the user cannot listen to the radio.

   This check box is selected by default.

   Allow modification of Bluetooth settings (supervised only, iOS 11+)

   If the check box is selected, the user can modify Bluetooth settings on the mobile device.

   If the check box is cleared, Bluetooth settings cannot be modified on the mobile device.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow use of NFC (supervised only, iOS 14.2+)

   If the check box is selected, the use of NFC is allowed.

   If the check box is cleared, the use of NFC is disabled.

   The setting is available for mobile devices running iOS version 14.2 or later.

   This check box is selected by default.

   Allow voice dialing on a locked device

   Use of the voice dialing function on a locked mobile device.

   If the check box is selected, the user can use voice commands to dial phone numbers on a locked mobile device.

   If the check box is cleared, the user cannot use voice commands to dial phone numbers on a locked mobile device.

   This check box is selected by default.

   Allow use of Siri

   Usage of the Siri app on the user's mobile device.

   If the check box is selected, the user can use voice commands of the Siri app on the mobile device.

   If the check box is cleared, the user cannot use voice commands of the Siri app on the mobile device.

   This check box is selected by default.

   Allow use of profanity filter (supervised only)

   This option enables the filtering of profanity while using the Siri app on the mobile device.

   If the check box is selected, profanity is filtered while the user uses the Siri app.

   If the check box is cleared, profanity is not filtered while the user uses the Siri app.

   This check box is selected by default.

   Allow when device is locked

   Use of Siri voice commands when the user's mobile device is locked. The user's mobile device has to be password-protected. This setting is available if the Allow use of Siri check box is selected.

   If the check box is selected, the user can use Siri voice commands on a locked mobile device.

   If the check box is cleared, the user cannot use Siri voice commands on a locked device.

   This check box is selected by default.

   Show user's content (supervised only)

   This option allows adding personal data of the user to Siri so they can be used in Siri voice commands (for example: "remind me to call wife when I get home") on the iOS MDM device. This setting is available if the Allow use of Siri check box is selected.

   If the check box is selected, the user can fill out a personal card in Siri settings and use this information in Siri voice commands.

   If the check box is cleared, the user is not allowed to add personal data to Siri.

   This check box is selected by default.

   Allow AirPrint (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can use AirPrint.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow storage of AirPrint credentials (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can store a keychain of user name and password for AirPrint.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow iBeacon discovery of AirPrint printers (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether iBeacon discovery of AirPrint printers is enabled. Disabling iBeacon discovery of AirPrint printers prevents spurious AirPrint Bluetooth beacons from getting information about network traffic.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Force AirPrint to use a trusted TLS certificate (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether a trusted certificate is required for TLS printing communication.

   The restriction is supported on devices with iOS 11 and later.

   The check box is cleared by default.

   Allow iBooks Store (supervised only)

   Access to iBooks Store from the iBooks app on the user's mobile device.

   If the check box is selected, the user can visit iBooks Store from the iBooks app installed on the device.

   If the check box is cleared, the user cannot visit iBooks Store from the iBooks app.

   This check box is selected by default.

   Allow installation of apps from Apple Configurator and iTunes (supervised only)

   The user can independently install apps on an iOS MDM device.

   If the check box is selected, the user can independently install or update apps on a mobile device from App Store using iTunes, Apple Configurator, or Kaspersky Device Management for iOS.

   If the check box is cleared, the user cannot install or update apps from App Store using iTunes, Apple Configurator, or Kaspersky Device Management for iOS on a mobile device. Installation and upgrade are available only for corporate apps. The App Store icon is hidden on the home screen of the iOS MDM device.

   This check box is selected by default.

   Allow installation of apps from App Store (supervised only)

   Capability to independently install apps to a mobile device from App Store. The check box is available if the Allow installation of apps from Apple Configurator and iTunes check box is selected.

   If the check box is selected, the user can independently install or update apps from App Store.

   If the check box is cleared, the user cannot install or update apps from App Store on the mobile device. The App Store icon is hidden on the home screen of the iOS MDM device.

   This check box is selected by default.

   Allow automatic loading of apps (supervised only)

   Use of the function for automatic loading of apps to the user's mobile device. The check box is available if the Allow installation of apps from Apple Configurator and iTunes and Allow installation of apps from App Store check boxes are selected.

   If the check box is selected, automatic loading of apps is available to the user (Settings > iTunes and App Store > Applications). After this function is enabled, the apps that the user acquired from App Store are automatically loaded to the user's other Apple devices.

   If the check box is cleared, the function for automatic loading of apps is disabled and unavailable.

   This check box is selected by default.

   Allow removing apps (supervised only)

   This option allows removing apps from the mobile device.

   If the check box is selected, the user can remove apps installed via App Store or iTunes from the device.

   If the check box is cleared, the user cannot remove apps installed via App Store or iTunes from the mobile device.

   This check box is selected by default.

   Allow In-App Purchases

   Use of the in-App Purchase system on the mobile device.

   If the check box is selected, the user can make purchases in apps installed on the mobile device.

   If the check box is cleared, the user cannot make purchases in apps installed on the mobile device.

   This check box is selected by default.

   Prompt for password for each purchase through iTunes Store

   Use of the restriction password for purchasing media content in iTunes Store.

   If the check box is selected, prior to making the first purchase via iTunes Store the user has to specify the restriction password in purchase restriction settings and subsequently use it for preventing accidental or unauthorized purchases. After the account has been verified when the user is making purchases, the restriction password does not have to be re-entered for another 15 minutes.

   If the check box is cleared, the user is not required to enter the restriction password before making purchases in iTunes Store.

   This check box is cleared by default.

   Allow iCloud backup

   Automatic data backup from the iOS MDM device to iCloud. Copies of data already stored in iCloud are not created during the backup process. Copies of media content that was received by synchronizing the device with a computer and not purchased from iTunes Store are not created either.

   If the check box is selected, the user can save backup copies of mobile device data in iCloud. Backup copies of data are saved in iCloud on a daily basis when the device is enabled, locked, and connected to a power source.

   If the check box is cleared, the user cannot save backup copies of mobile device data in iCloud.

   This check box is selected by default.

   Allow storing documents and data in iCloud (supervised only)

   Automatic backup of documents in iCloud. iCloud documents can be opened and edited on other devices on which the iCloud service is configured.

   If the check box is selected, the user can save documents in iCloud, open and edit them on other devices in applications that support iCloud (such as TextEdit).

   If the check box is cleared, the user is not allowed to save documents in iCloud.

   This check box is selected by default.

   Allow iCloud Keychain

   Automatic synchronization of the account credentials of an iOS MDM device user with other Apple devices of the user. Data to be synchronized is stored in iCloud Keychain. Data in iCloud Keychain is encrypted. iCloud Keychain makes it possible to save the following data in iCloud:

   • Website accounts
   • Bank card numbers and expiry dates
   • Wireless network passwords

   If the check box is selected, the user can synchronize data of accounts with other Apple devices of the user.

   If the check box is cleared, the user is not allowed to use iCloud Keychain on the mobile device.

   This check box is selected by default.

   Allow managed apps to store data in iCloud

   Creation of a backup copy of the data of managed apps in iCloud. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS.

   If the check box is selected, the user can store the data of managed apps in iCloud.

   If the check box is cleared, the user cannot store corporate data in iCloud.

   This check box is selected by default.

   Allow backup of enterprise books

   Backup copying of enterprise books using iCloud or iTunes. You can provide access to enterprise books by placing them on the corporate web server.

   If the check box is selected, backup copying of enterprise books using iCloud or iTunes is available to the user.

   If the check box is cleared, backup copying of enterprise books is not available.

   This check box is selected by default.

   Allow synchronization of notes and highlights in enterprise books

   Capability to synchronize notes, bookmarks, and highlighted text in enterprise books using iCloud.

   If the check box is selected, the user can perform synchronization of notes, bookmarks, and highlights in enterprise books (Settings > iBooks > Sync bookmarks and notes). Changes will be available on all the user's Apple devices using iCloud.

   If the check box is cleared, notes, bookmarks and highlighted text will be available only on this mobile device.

   This check box is selected by default.

   Allow iCloud photo sharing

   Use of iCloud photo sharing on the iOS MDM device to grant other users access to photos and videos on the iCloud server. The other uses need to have the iCloud Photo Sharing feature configured.

   If the check box is selected, the iCloud Photo Sharing feature is available to the user. Users of other devices can view the user's photos and videos, leave comments, and add their own photos and videos. The user can also access data of other users on the iCloud server.

   If the check box is cleared, the iCloud Photo Sharing feature is not available to the user. The user cannot grant other uses access to the user's photos and videos on the iCloud server or access data of other users on the iCloud server.

   This check box is selected by default.

   Allow iCloud Media Library

   Use of the iCloud Media Library function for automatic uploading of photos and videos from the iOS MDM device to other Apple devices of the user.

   If the check box is selected, the iCloud Media Library function is available to the user when working with the Photo app.

   If the check box is cleared, the iCloud Media Library function is not available to the user. The user's photos and videos saved in the iCloud Media Library are removed from the iCloud server.

   This check box is selected by default.

   Allow My Photo Stream (disallowing may result in loss of data)

   Use of the Allow My Photo Stream feature for automatic uploading of photos and videos from the iOS MDM device to other Apple devices of the user. The photos and videos are stored in the My Photo Stream folder on the iCloud server for 30 days.

   If the check box is selected, the user has access to the My Photo Stream feature when using the iPhoto or Aperture apps.

   If the check box is cleared, the user is not allowed access to the My Photo Stream feature. The user's photos and videos saved in the My Photo Stream folder are removed from the iCloud server.

   This check box is selected by default.

   Allow automatic sync while roaming

   Automatic synchronization of user data when the iOS MDM device is roaming.

   If the check box is selected, the user can enable automatic data synchronization when the device is roaming. Enabling automatic synchronization in roaming can result in unexpected mobile service costs.

   If the check box is cleared, the user is not allowed to use automatic data synchronization when the device is roaming.

   This check box is selected by default.

   Enable encryption of backup copies

   Encryption of backup copies of iOS MDM device data in the iTunes app on the user's computer.

   Data of the Kaspersky Device Management for iOS configuration policy is not encrypted regardless of whether or not encryption of the backup copy of data is enabled.

   If the check box is selected, when a backup copy of mobile device data is created in the iTunes app, data is encrypted automatically and protected with a password. In this case, the user cannot encrypt backup copies of device data in the iTunes app.

   If the check box is cleared, the user may choose whether or not to use encryption of backup copies of data in the iTunes app.

   This check box is cleared by default.

   Limit ad tracking

   Use of IFA (Identifier for advertisers) technology for keeping track of websites visited and apps launched on the iOS MDM device. IFA makes it possible to configure ad tracking on the mobile device according to the user's interests.

   If the check box is selected, IFA technology is disabled on the user's mobile device.

   If the check box is cleared, IFA technology is enabled on the mobile device and keeps track of websites visited and apps started in order to show targeted ads.

   This check box is cleared by default.

   Allow full reset (supervised only)

   Capability to wipe all data from the device and reset the device to its factory settings.

   If the check box is selected, the user can wipe all data from the device and reset it to factory settings (Settings > General > Reset > Wipe content and settings).

   If the check box is cleared, full reset to factory settings is not available.

   This check box is selected by default.

   Allow users to accept untrusted TLS certificates

   Use of untrusted TLS certificates for providing an encrypted communication channel between apps on the iOS MDM device (Mail, Contacts, Calendar, Safari) and corporate resources.

   If the check box is selected, the user may allow the use of an untrusted TLS certificate after being shown a warning.

   If the check box is cleared, Kaspersky Device Management for iOS automatically blocks the use of untrusted TLS certificates.

   This check box is selected by default.

   Allow automatic updates of trusted certificates

   Automatic update of trusted certificates on the iOS MDM device.

   If the check box is selected, Kaspersky Device Management for iOS automatically applies changes made to the trust settings of a certificate.

   If the check box is cleared, changes to trust settings of a certificate are not applied automatically. After being shown a warning, the user may choose to apply changes to trust settings of the certificate.

   This check box is selected by default.

   Allow trusting of new enterprise developers

   Capability to configure trusting of corporate apps on a mobile device. You can develop corporate apps and distribute them among employees for internal use. To work with a corporate app, the mobile device user must make it a trusted app. When installing apps via Kaspersky Device Management for iOS, the trust level of apps is automatically set.

   If the check box is selected, the user can configure trusting of corporate apps (Settings > General > Profiles or Profiles and device management).

   If the check box is cleared, the user cannot set the trust level for corporate apps when installing an app manually. You can install apps only through Kaspersky Device Management for iOS. The trust level of apps will be set automatically.

   This check box is selected by default.

   Allow installing configuration profiles (supervised only)

   Use of additional configuration profiles (other than Kaspersky Security Center policies) on the iOS MDM device.

   If the check box is selected, the user can install additional configuration profiles on the mobile device.

   If the check box is cleared, the user cannot install additional configuration profiles, other than Kaspersky Security Center policies, on the mobile device.

   This check box is selected by default.

   Allow editing account settings (supervised only)

   The option that lets the user add new accounts (such as email accounts) and edit account settings on the iOS MDM device.

   If the check box is selected, the mobile device user can add new accounts and edit the settings of existing accounts.

   If the check box is cleared, the mobile device user is not allowed to add new accounts and edit the settings of existing accounts.

   This check box is selected by default.

   Allow modification of cellular communication settings (supervised only)

   Capability to configure cellular network data transfer by apps installed on a mobile device.

   If the check box is selected, the user can configure the settings for data transfer over a cellular network (Settings > Cellular communications > Cellular data for apps).

   If the check box is cleared, the settings for cellular network data transfer by apps cannot be modified.

   This check box is selected by default.

   Allow device name editing (supervised only)

   Capability to modify the name of the mobile device.

   If the check box is selected, the user can edit the mobile device name (Settings > General > About this device > Name).

   If the check box is cleared, the device name cannot be edited.

   This check box is selected by default.

   Allow use of Find My Device in the Find My app (supervised only, iOS 13+)

   Selecting or clearing this check box specifies whether the device user can use Find My Device in the Find My app.

   The restriction is supported on devices with iOS 13 and later.

   The check box is selected by default.

   Allow use of Find My Friends in the Find My app (supervised only, iOS 13+)

   Selecting or clearing this check box specifies whether the device user can use Find My Friends in the Find My app.

   The restriction is supported on devices with iOS 13 and later.

   The check box is selected by default.

   Allow editing Find My Friends settings (supervised only)

   The option that lets the user edit the settings of the Find My Friends app on the iOS MDM device.

   If the check box is selected, the user can edit the settings of the Find My Friends app on the iOS MDM device.

   If the check box is cleared, the user cannot edit the configured settings of the Find My Friends app on the iOS MDM device.

   This check box is selected by default.

   Allow editing of notification settings (supervised only)

   Capability to configure the display of notifications on the mobile device.

   If the check box is selected, the user can configure the settings for displaying notifications on the mobile device (Settings > General > Notifications).

   If the check box is cleared, the display of notifications cannot be configured.

   This check box is selected by default.

   Allow password change (supervised only)

   Capability to set, change, or delete the mobile device unlock password.

   If the check box is selected, the user can set, change, or delete the password used for unlocking the mobile device (Settings > Password).

   If the check box is cleared, management of the device unlock password is not available.

   This check box is selected by default.

   Allow modification of Touch ID and Face ID (supervised only)

   Capability to add and remove Touch ID fingerprints or Face ID data. This setting is available if the Allow password change check box is selected.

   You can manage Face ID on devices running iOS version 11.0 or later.

   If the check box is selected, the user can add and remove Touch ID fingerprints or Face ID data (Settings > Touch ID & Passcode / Face ID & Passcode > Fingerprints).

   If the check box is cleared, Touch ID fingerprint or Face ID data management is not available.

   This restriction cannot be applied on iPad devices.

   This check box is selected by default.

   Allow modification of restrictions (supervised only)

   Capability to configure the settings for restrictions on the mobile device. Restrictions may be utilized by the user to perform parental control functions on the mobile device. The user can restrict device functions (for example, block use of the camera), access to media content (for example, set age restrictions on viewing films), use of apps (for example, block the use of iTunes Store), and configure other restrictions.

   If the check box is selected, the user can configure the settings for restrictions on the mobile device (Settings > General > Restrictions).

   If the check box is cleared, restrictions cannot be configured on the mobile device.

   This check box is selected by default.

   Allow wallpaper change (supervised only)

   Capability to select the image that will be displayed on the lock screen or Home screen.

   If the check box is selected, the user can select the wallpaper for the mobile device.

   If the check box is cleared, wallpaper selection is not available.

   This check box is selected by default.

   Allow pairing with non-Configurator hosts (supervised only)

   Protection of the iOS MDM device against third-party connections. A third-party connection is a connection to other devices or synchronization with Apple services, such as iTunes.

   If the check box is selected, the user can synchronize the iOS MDM device with other devices and Apple services.

   If the check box is cleared, Kaspersky Device Management for iOS blocks non-Configurator hosts on the user's mobile device.

   This check box is selected by default.

   Allow non-managed apps to use documents from managed apps

   Possibility to use unmanaged (personal) apps on the iOS MDM device to open documents created using managed (corporate) apps and accounts. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, the user can open documents created managed corporate apps in unmanaged apps.

   If the check box is cleared, the user is not allowed to open documents created using managed apps in unmanaged apps. For example, this setting prevents the opening of a confidential email attachment from a managed email account in personal apps of the user.

   This check box is selected by default.

   Allow managed apps to use documents from non-managed apps

   Possibility to use managed (corporate) apps on the iOS MDM device to open documents created using unmanaged (personal) apps and accounts of the user. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, the user can open documents created using unmanaged apps in managed apps.

   If the check box is cleared, the user is not allowed to open documents created using unmanaged apps in managed apps. For example, this setting prevents a document from a personal iCloud account from being opened in a corporate app.

   This check box is selected by default.

   Treat AirDrop as unmanaged app

   Use of AirDrop as an unmanaged app for transferring data from the mobile device to other Apple devices. This restriction requires that you clear the Allow non-managed apps to use documents from managed apps check box. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, AirDrop is treated as an unmanaged app.

   If the check box is cleared, AirDrop is treated as a managed app.

   This check box is selected by default.

   Allow Handoff

   Use of the Handoff function on the user's mobile device. Handoff enables you to start working with data on one Apple device and then switch to another Apple device and continue working with that data.

   If the check box is selected, Handoff is available to the user.

   If the check box is cleared, Handoff is not available.

   This check box is selected by default.

   Allow Spotlight suggestions (supervised only)

   Use of Spotlight suggestions for the Search function on the user's mobile device. Spotlight enables you to show search results from the Internet, iTunes Store, App Store, and other sources when using the Search function. When using Spotlight suggestions, search queries and their associated user data are sent to Apple.

   If the check box is selected, the user can allow Spotlight suggestions to be added to the Search function (Settings > General > Spotlight search > Spotlight suggestions).

   If the check box is cleared, Spotlight suggestions are not available. User data is not sent to Apple.

   This restriction cannot be applied on iPadOS devices.

   This check box is selected by default.

   Allow diagnostic and personal data to be sent to Apple

   Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with such data to Apple for analysis.

   If the check box is selected, after being shown a warning the user may allow transmission of reports with diagnostic data and information on mobile device usage to Apple.

   If the check box is cleared, Kaspersky Device Management for iOS blocks transmission of reports with diagnostic data and information on mobile device usage to Apple.

   This check box is selected by default.

   Allow modification of diagnostic data transmission settings (supervised only)

   Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with such data to Apple for analysis. This setting is available if the Allow diagnostic and personal data to be sent to Apple check box is selected.

   If the check box is selected, the user can configure the submission of reports containing diagnostic information and mobile device usage data to Apple (Settings > Confidentiality > Diagnostics and usage).

   If the check box is cleared, the settings for submission of reports containing diagnostic information are not available.

   This check box is selected by default.

   Allow unlocking device through Touch ID or Face ID

   Use of Touch ID and Face ID technologies make it possible to use a fingerprint or facial recognition as a password for unlocking the iOS MDM device. Touch ID and Face ID can also be used for authentication of purchases by means of Apple Pay, iTunes Store, App Store, iBooks Store and to sign in into apps.

   You can manage Face ID on devices running iOS version 11.0 or later.

   If the check box is selected, the user can use a fingerprint or facial recognition instead of a password for unlocking the mobile device.

   If the check box is cleared, the user cannot use Touch ID or Face ID technology for unlocking the mobile device.

   This check box is selected by default.

   Enable Apple Watch wrist detection

   Automatic locking of Apple Watch when the user removes the watch from his or her hand.

   If the check box is selected, Apple Watch is locked when the user removes a watch from his or her hand (Apple Watch > My watch > General > Wrist detection). To unlock it, the user must enter a password on the mobile device.

   If the check box is cleared, Apple Watch cannot be locked after a watch is removed.

   This check box is selected by default.

   Allow pairing with Apple Watch (supervised only)

   Pairing of Apple Watch with a controlled mobile device.

   If the check box is selected, the user of the controlled mobile device can create a pairing with Apple Watch.

   If the check box is cleared, pairing with Apple Watch is not available.

   This check box is selected by default.

   Prompt for password on first connection to AirPlay

   Use of a password upon connection of the iOS MDM device to devices compatible with AirPlay. The password is used for safe transmission of media content.

   If the check box is selected, before the first connection of the mobile device to devices compatible with AirPlay, the user must specify the password in the AirPlay security settings and subsequently enter it.

   If the check box is cleared, the user is free to decide whether or not to use a password when connecting the mobile device to devices compatible with AirPlay.

   This check box is cleared by default.

   Allow predictive keyboard (supervised only)

   Use of the predictive text input function. The predictive text input function shows options for completing words and suggestions based on available dictionaries.

   If the check box is selected, the user can enable and use the predictive text input function (Settings > General > Keyboard > Predictive text).

   If the check box is cleared, the predictive text function is not available. In this case, suggestions are not displayed when entering text.

   This check box is selected by default.

   Allow keyboard shortcuts (supervised only)

   Use of keyboard shortcuts for quick access to mobile device functions.

   If the check box is selected, the user can enable the keyboard shortcut function and use it when working with the mobile device (Settings > General > Universal access > Keyboard shortcut).

   If the check box is cleared, the keyboard shortcut function is not available.

   This check box is selected by default.

   Allow auto correction (supervised only)

   Use of the auto correction function when entering text.

   If the check box is selected, the user can enable and use the auto correction function (Settings > General > Keyboard > Auto correction).

   If the check box is cleared, auto correction is not available when entering text.

   This check box is selected by default.

   Allow spellcheck (supervised only)

   Use of spellcheck when entering text on a mobile device. The spellcheck function underlines incorrectly spelled words and suggests corrections.

   If the check box is selected, the user can enable and use the spellcheck function (Settings > General > Keyboard > Spellcheck).

   If the check box is cleared, spellcheck is not available when entering text.

   This check box is selected by default.

   Allow dictionary search (supervised only)

   Obtaining the definition of a word in a dictionary on the mobile device. Only a software keyboard has a dictionary function.

   If the check box is selected, the user can highlight any word on the screen of the mobile device and receive the definition of that word.

   If the check box is cleared, dictionary search is not available.

   This check box is selected by default.

   Allow Wallet on-screen notifications when screen is locked

   Use of Wallet notifications on the lock screen of the iOS MDM device.

   If the check box is selected, Wallet notifications are displayed on the lock screen of the mobile device.

   If the check box is cleared, Wallet notifications are not displayed on the lock screen of the mobile device. To work with Wallet, the user must unlock the device.

   This check box is selected by default.

   Show Control Center when screen is locked

   Possibility to go to the Control Center of the iOS MDM device when the device is locked.

   If the check box is selected, the user can go to the Control Center by swiping the lock screen up.

   If the check box is cleared, the user cannot go to the Control Center when the device is locked.

   This check box is selected by default.

   Show Notification Center when screen is locked

   Possibility to go to the Notification Center of the iOS MDM device when the device is locked.

   If the check box is selected, the user can go to the Notification Center by swiping the lock screen down.

   If the check box is cleared, the user cannot go to the Notification Center when the device is locked.

   This check box is selected by default.

   Show Today when screen is locked

   Display of information from the Today section of the Notification Center on the screen of a locked iOS MDM device. The Today section of the Notification Center shows the following information:

   • Planned Calendar events
   • Reminders
   • Stock prices
   • Weather

   If the check box is selected, the user can view notifications from the Today section of the Notification Center on a locked mobile device.

   If the check box is cleared, the Today section is not displayed on the locked mobile device.

   This check box is selected by default.

7. Click the Apply button to save the changes you have made.
8. Select the Restrictions for applications section.
9. In the Applications restriction settings section, select the Apply settings on device check box.
10. Configure restrictions for apps on the iOS MDM device.
11. Click the Apply button to save the changes you have made.
12. Select the Restrictions for Media Content section.
13. In the Media content restriction settings section, select the Apply settings on device check box.
14. Configure restrictions for media content on the iOS MDM device.
15. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, restrictions on features, apps, and media content will be configured on the user's mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring user access to websites

This section contains instructions on how to configure access to websites on Android and iOS devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring access to websites on Android devices

You can use Web Protection to configure access of Android device users to websites. Web Protection supports website filtering by categories defined in Kaspersky Security Network cloud service. Filtering allows you to restrict user access to certain websites or categories of websites (for example, those from the "Gambling, lotteries, sweepstakes", or "Internet communication" categories). Web Protection also protects the personal data of users on the internet.

To enable Web Protection:

• The Statement regarding data processing for the purpose of using Web Protection (Web Protection Statement) should be accepted. Kaspersky Endpoint Security uses Kaspersky Security Network (KSN) to scan websites. The Web Protection Statement contains the terms of data exchange with KSN.

  You can accept the Web Protection Statement for the user in Kaspersky Security Center. In this case, the user is not required to take any action.

  If you have not accepted the Web Protection Statement and prompt the user to do this, the user must read and accept the Web Protection Statement in the app settings.

  If you have not accepted the Web Protection Statement, Web Protection is not available.

Web Protection on Android devices is supported only by Google Chrome, HUAWEI Browser, Samsung Internet Browser, and Yandex Browser.

If the Kaspersky Endpoint Security for Android app in device owner mode is not enabled as an Accessibility Features service, Web Protection is supported only by the Google Chrome browser and checks only the domain of a website. To allow other browsers (Samsung Internet Browser, Yandex Browser, and HUAWEI Browser) support Web Protection, enable Kaspersky Endpoint Security as an Accessibility Features service. This will also enable the Custom Tabs feature operation.

The Custom Tabs feature is supported by Google Chrome, HUAWEI Browser, and Samsung Internet Browser.

Web Protection for HUAWEI Browser, Samsung Internet Browser, and Yandex Browser does not block sites on a mobile device if a work profile is used and Web Protection is enabled only for the work profile.

Web Protection is enabled by default: user access to websites in the Phishing and Malware categories is blocked. On devices managed by the Kaspersky Endpoint Security for Android app in device owner mode, Web Protection is supported only by the Google Chrome browser and checks only the domain of a website. To allow other browsers (Samsung Internet Browser, Yandex Browser, and HUAWEI Browser) to support Web Protection, Kaspersky Endpoint Security must be enabled as an Accessibility Features service.

To configure the settings of the device user's access to websites:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Web Protection.
5. To use Web Protection, you or device user must read and accept the Statement regarding data processing for the purpose of using Web Protection (Web Protection Statement):
   1. Click the Web Protection Statement link at the top of the section.

      This opens Statement regarding data processing for purpose of using Web Protection window.

   2. Read and accept Privacy Policy by selecting the corresponding check box. To view Privacy Policy, click the Privacy Policy link.

      If you do not accept Privacy Policy, mobile device user can accept Privacy Policy in the Initial Configuration Wizard or in the app ( → About → Terms and conditions → Privacy Policy).

   3. Select the Web Protection Statement acceptance mode:
      • I have read and accept the Web Protection Statement
      • Request acceptance of the Web Protection Statement from the device user
      • I do not accept the Web Protection Statement

        If you select I do not accept the Web Protection Statement, the Web Protection does not block sites on a mobile device. Mobile device user cannot enable Web Protection in the Kaspersky Endpoint Security.

   4. Click OK to close the window.

   

   Step 5. Accept the Statement regarding data processing for purpose of using Web Protection.

6. Select the Enable Web Protection check box.
7. If you want the app to check a full URL when opening a website in Custom Tabs, select the Check full URL when using Custom Tabs check box.

   Custom Tabs is an in-app browser that allows the user to view web pages without having to leave the app and switch to a full web browser version. This option provides better detection of a URL and its check against the configured Web Protection rules. If the check box is selected, Kaspersky Endpoint Security for Android opens the website in a full version of the browser and checks whole web address of the website. If the check box is cleared, Kaspersky Endpoint Security for Android checks only the domain of a website in Custom Tabs.

8. Select one of the following options:
   • If you want the app to restrict user access to websites depending on their content, do the following:
     1. In the Web Protection section, in the drop-down list select Websites of selected categories are forbidden.
     2. Create a list of blocked categories by selecting check boxes next to the categories of websites to which the app will block access.

   

   Step 8. Web Protection section. Select the categories of websites to block access to.

   • If you want the app to allow or restrict user access only to websites specified by the administrator, do the following:
     1. In the Web Protection section, in the drop-down list select Only listed websites are allowed or Only listed websites are blocked.

        If Kaspersky Endpoint Security for Android is not set as an Accessibility feature, Web Protection may block an allowed website that loads some elements from a website with a domain that is not in the list of allowed domains.

     2. Create a list of websites by adding addresses of websites to which the app will allow or block access, depending on the value selected in the drop-down list. You can add websites by link (full URL, including the protocol, e.g. https://example.com).

        To make sure that the app allows or blocks access to the specified website in all supported versions of Google Chrome, HUAWEI Browser, Samsung Internet Browser, and Yandex Browser, include the same URL twice, once with the HTTP protocol (e.g., http://example.com) and once with the HTTPS protocol (e.g., https://example.com).

        For example:

        • https://example.com—The main page of the website is either allowed or blocked. This URL can only be accessed through the HTTPS protocol.
        • http://example.com—The main page of the website is either allowed or blocked, but only when accessed through the HTTP protocol. Other protocols like HTTPS are not affected.
        • https://example.com/page/index.html—Only the index.html page of the website will be allowed or blocked. The rest of the website is not affected by this entry.

        The app also supports regular expressions. When entering the address of an allowed or blocked website, use the following templates:

        • https://example\.com/.*—This template blocks or allows all child pages of the website, accessed via the HTTPS protocol (for example, https://example.com/about).
        • https?://example\.com/.*—This template blocks or allows all child pages of the website, accessed via both the HTTP and HTTPS protocols.
        • https?://.*\.example\.com—This template blocks or allows all subdomain pages of the website (e.g., https://pictures.example.com).
        • https?://example\.com/[abc]/.*—This template blocks or allows all child pages of the website where the URL path begins with 'a', 'b', or 'c' as the first directory (e.g., https://example.com/b/about).
        • https?://\w{3,5}.example\.com/.*—This template blocks or allows all child pages of the website where the subdomain consists of a word with 3 to 5 characters (e.g., http://abde.example.com/about).

        Use the expression https? to select both the HTTP and HTTPS protocols. For more details on regular expressions, please refer to the Oracle Technical Support website.

   

   Step 9. Web Protection section. Specify the list of websites to allow access to.

   • If you want the app to block user access to all websites, in the Web Protection section, in the drop-down list, select All websites are blocked.
9. To lift content-based restrictions on user access to websites, clear the Enable Web Protection check box.
10. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Managing the website list

You can manage the list of websites with the following buttons:

• Add - Click to add a website to the list by entering a URL or regular expression.
• Import - Click to add multiple websites to the list by specifying a .txt file which contains the required URLs or regular expressions. The file must be encoded in UTF-8. URLs or regular expressions in the file must be separated by semicolons or by line breaks.
• Edit - Click to change the address of a website.
• Delete - Click to remove a website from the list. To remove multiple websites from the list, select them with the CTRL+A, CTRL+left-click, or SHIFT+left-click hotkeys, and then click Delete.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring access to websites on iOS MDM devices

Configure Web Protection settings to control access to websites for iOS MDM device users. Web Protection controls a user's access to websites based on lists of allowed and blocked websites. Web Protection also lets you add website bookmarks on the bookmark panel in Safari.

By default, access to websites is not restricted.

Web Protection settings can be configured for supervised devices only.

To configure access to websites on the user's iOS MDM device:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Web Protection section.
5. In the Web Protection settings section, select the Apply settings on device check box.
6. To block access to blocked websites and allow access to allowed websites:
   1. In the Web Filter Mode drop-down list, select the Limit adult content mode.
   2. In the Allowed websites section, create a list of allowed websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS allows access to all websites in the domain. For example, if you have added http://www.example.com to the list of allowed websites, access is allowed to http://pictures.example.com and http://example.com/movies. If the list of allowed websites is empty, the application allows access to all websites other than those included in the list of blocked websites.

   3. In the Forbidden websites section, create a list of blocked websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS blocks access to all websites in the domain.

7. To block access to all websites other than allowed websites on the tab list:
   1. In the Web Filter Mode drop-down list, select the Allow bookmarked websites only mode.
   2. In the Bookmarks section, create a list of bookmarks of allowed websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS allows access to all websites in the domain. If the bookmark list is empty, the application allows access to all websites. Kaspersky Device Management for iOS adds websites from the list of bookmarks on the bookmarks tab in Safari in the user's mobile device.

8. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, Web Protection will be configured on the user's mobile device according to the mode selected and lists created.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Compliance control

This section contains instructions on how to monitor device compliance with corporate requirements and how to configure compliance control rules.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Compliance control of Android devices with corporate security requirements

You can control Android devices for compliance with the corporate security requirements. Corporate security requirements regulate how the user can work with the device. For example, the real-time protection must be enabled on the device, the anti-malware databases must be up-to-date, and the device password must be sufficiently strong. Compliance control is based on a list of rules. A compliance rule includes the following components:

• Device check criterion (for example, absence of blocked apps on the device).
• Time period allocated for the user to fix the non-compliance (for example, 24 hours).
• Actions that will be taken on the device if the user does not fix the non-compliance within the set time period (for example, lock the device).

  If the device is in battery saver mode, the app may perform this task later than specified. To ensure timely responses of KES devices on Android to the administrator's commands, enable the use of Google Firebase Cloud Messaging.

To create a rule for checking devices for compliance with a group policy:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Compliance Control section.
5. To receive notifications about devices that do not comply with the policy, in the Non-compliance notification section select the Notify administrator check box.

   If the device does not comply with a policy, during device synchronization with the Administration Server, Kaspersky Endpoint Security for Android writes an entry for Violation detected: <name of the criterion checked> in the event log. You can view the Event log on the Events tab in the Administration Server properties or in the local properties of the application.

6. To notify the device user that the user's device does not comply with the policy, in the Non-compliance notification section select the Notify user check box.

   If the device does not comply with a policy, during device synchronization with the Administration Server, Kaspersky Endpoint Security for Android notifies the user about this.

7. In the Compliance Control rules section, compile a list of rules for checking the device for compliance with the policy.
8. To add a rule, click Add.

   The Compliance Rule Wizard starts. Proceed through the wizard by using the Next button.

9. Select a non-compliance criterion for the rule.

   The following criteria are available:

   • Real-time protection is disabled

     Checks whether the security app is not installed on the device or is not running.

   • Anti-malware databases are out of date

     Checks whether the anti-malware databases were last updated 3 or more days ago.

   • Forbidden apps are installed

     Checks whether the list of apps on the device contains apps that are set as forbidden in the App Control.

   • Apps from forbidden categories are installed

     Checks whether the list of apps on the device contains apps from the categories that are set as forbidden in the App Control.

   • Not all required apps are installed

     Checks whether the list of apps on the device does not contains an app that is set as required in the App Control.

   • Operating system version is out of date

     Checks whether the Android version on the device is within the allowed range.

     For this criterion, specify the minimum and maximum allowed versions of Android. If the maximum allowed version is set to Any, it means that future Android versions supported by Kaspersky Endpoint Security for Android will also be allowed.

   • Device has not been synchronized for a long time

     Checks how long ago the device last synchronized with Administration Server.

     For this criterion, specify the maximum period after the last sync.

   • Device has been rooted

     Checks whether the device is hacked (whether root access is gained on the device).

   • Unlock password is not compliant with security requirements

     Checks whether the unlock password on the device does not comply with the settings defined in the Device Management section of the policy.

   • Installed version of Kaspersky Endpoint Security for Android is not supported

     Checks whether the security application installed on the device is not obsolete.

     This criterion applies only to an app installed using a Kaspersky Endpoint Security for Android installation package and if the latest version is specified in the Upgrade of Kaspersky Endpoint Security for Android section of Additional properties of the policy.

     For this criterion, you also need to specify the minimum allowed version of Kaspersky Endpoint Security for Android.

   • SIM card usage is not compliant with security requirements

     Checks whether the device SIM card has been replaced or removed compared to the previous check state.

     You can also enable the check for an additional SIM card.

     In some cases, replacement, removal, and insertion of an eSIM is also checked.

   • Device is within or outside the geofence areas

     Specifying the geofence area will result in increased device power consumption.

     For this criterion, select the specific requirement that must be monitored:

     • The device is within any of the geofence areas in the list (the geofence areas are combined using the OR logical operator).
     • The device is outside all of the geofence areas in the list (the geofence areas are combined using the AND logical operator).

     In the List of geofence areas block, you can add, edit, or delete geofence areas.

     To add a new geofence area:

     1. Click the Add button.

        Opens the Add geofence area window.

     2. Specify the Geofence area name.
     3. In the Coordinates of the geofence area perimeter section, specify a latitude and a longitude for each point.

        If you want to add more than 3 points, click the Add point button. To delete a point, click the X button.

        For each geofence area, you can manually enter from 3 to 100 coordinate pairs (latitude, longitude) as decimal numbers.

        A geofence area perimeter must not contain intersecting lines.

     4. You can view the specified geofence area in the Yandex.Maps program, by clicking the View on map button.
     5. Click the Add button to add the specified geofence area.

        The new geofence area appears in the list.

     To edit a geofence area:

     1. Select the geofence area you want to edit, and then click the Edit button.
     2. Specify the new geofence area settings, as described earlier.
     3. Click the Add button.

        The edited geofence area appears in the list.

     To delete a geofence area:

     1. Select the geofence area you want to delete, and then click the Delete button.

        The geofence area is removed from the list.

   • Kaspersky Endpoint Security for Android has no access to precise or background location

     Checks whether the Kaspersky Endpoint Security for Android app is not allowed to access the precise location of the device or use the device location in the background.

10. Select the actions to be performed on the device if the specified non-compliance criterion is detected. You can add multiple actions. They are combined by the AND logical operator.

    Some of the actions are continuous. Continuous actions remain in effect until one of the following conditions are met:

    • The non-compliance criterion no longer applies.
    • A policy is applied in which the corresponding Compliance Control rule is deleted.

    The following actions are available:

    • Block all apps except system apps

      All apps on the user's mobile device, except system apps, are blocked from starting.

      As soon as the non-compliance criterion selected for the rule is no longer detected on the device, the apps are automatically unblocked.

    • Lock device

      The mobile device is locked. To obtain access to data, you must unlock the device. If the reason for locking the device is not rectified after the device is unlocked, the device will be locked again after the specified time period.

    • Wipe corporate data

      The corporate data is wiped from the device. The list of wiped data depends on the mode in which the device operates:

      • On a personal device, KNOX container and mail certificate are wiped.
      • If the device operates in device owner mode, KNOX container and the certificates installed by Kaspersky Endpoint Security for Android (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
      • Additionally, if Android work profile is created, the work profile (its content, configurations, and restrictions) and the certificates installed in the work profile (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
    • Full reset

      All data is deleted from the mobile device and the settings are rolled back to their factory values. After this action is completed, the device will no longer be a managed device. To connect the device to Kaspersky Security Center, you must reinstall Kaspersky Endpoint Security for Android.

    • Lock work profile

      The work profile on the device is locked. To obtain access to the work profile, you must unlock it. If the reason for locking the work profile is not rectified after it is unlocked, the work profile will be locked again after the specified time period.

      The action is only applicable to Android 6 or later.

      After the work profile on a device is locked, the history of work profile passwords is cleared. It means that the user can specify one of the recent passwords, regardless of the work profile password settings.

    • Wipe data of all apps

      The action is only applicable to devices running Android 9 or later in device owner mode or with created Android work profile.

      If the device works in device owner mode, data of all apps on the device is wiped. If Android work profile is created on the device, data of all apps in the work profile is wiped.

      As a result, apps are rolled back to their default state.

    • Wipe data for a specified app

      The action is only applicable to devices running Android 9 or later in device owner mode or with created Android work profile.

      For this action, you need to specify the package name for the app whose data is to be deleted. How to get the package name of an app

      To get the package name of an app:

      1. Open Google Play.
      2. Find the required app and open its page.

      The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

      To get the package name of an app that has been added to Kaspersky Security Center:

      1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
      2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

      In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

      If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

      As a result, the app is rolled back to its default state.

    • Prohibit safe boot

      The user is not allowed to boot the device in safe mode.

      The action is only applicable to devices running Android 6 or later in device owner mode.

      This is a continuous action.

    • Prohibit use of camera

      The user is not allowed to use any cameras on the device.

      This is a continuous action.

    • Prohibit use of Bluetooth

      The device user is not allowed to turn on and configure Bluetooth in Settings.

      The action is only applicable to personal devices running Android 12 or earlier, devices operating in device owner mode, or devices with created Android work profile.

      This is a continuous action.

    • Prohibit use of Wi-Fi

      The device user is not allowed to use Wi-Fi and configure it in Settings.

      The action is only applicable to devices operating in device owner mode (all Android versions), personal devices running Android 9 or earlier.

      This is a continuous action.

    • Prohibit USB debugging features

      The user is not allowed to use USB debugging features and developer mode on the device.

      The action is only applicable to devices operating in device owner mode or devices with created Android work profile.

      This is a continuous action.

    • Prohibit airplane mode

      The user is not allowed to enable airplane mode on the device.

      The action is only applicable to devices running Android 9 or later in device owner mode.

      This is a continuous action.

      The new rule appears in the Compliance Control rules section.

11. To temporarily disable a rule that you have created, use the toggle switch opposite the selected rule.
12. In the Actions when user accounts are disabled in Active Directory section, you can configure the actions to perform on devices when a user account is disabled in Active Directory.

    These parameters require integration with Microsoft Active Directory.

    To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and choose one of the following actions:

    • Wipe corporate data
    • Reset to factory settings
13. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. If the user device does not comply with the rules, the restrictions you have specified in the scan rule list are applied to the device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Compliance control of iOS MDM devices with corporate security requirements

Expand all | Collapse all

Compliance Control allows you to monitor iOS MDM devices for compliance with corporate security requirements and take actions if non-compliance is found. Compliance Control is based on a list of rules. Each rule includes the following components:

• Status (whether the rule is enabled or disabled).
• Non-compliance criteria (for example, absence of the specified apps or operating system version).
• Actions performed on the device if non-compliance is found (for example, wipe corporate data or send an email message to the user).

To create a rule:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Compliance Control section.
5. In the Compliance Control rules section, click Add.

   The Compliance Control Rule Wizard starts.

6. Select the Enable rule check box if you want to activate the rule. If the check box is cleared, the rule is disabled.
7. On the Non-compliance criteria tab, click Add criterion and select a non-compliance criterion for the rule. You can add multiple criteria. They are combined by the AND logical operator.

   The following criteria are available:

   • List of apps on device

     Checks whether the list of apps on the device contains forbidden apps or does not contain required apps.

     For this criterion, you need to select a check type (Contains or Does not contain) and specify the app's bundle ID. How to get the bundle ID of an app

     To get the bundle ID of a native iPhone or iPad app,

     Follow the instruction in Apple documentation.

     To get the bundle ID of any iPhone or iPad app:

     1. Open App Store.
     2. Find the required app and open its page.

        The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

     3. Copy this identifier (without letters "id").
     4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

        This downloads a text file.

     5. Open the downloaded file and find there the "bundleId" fragment.

     The text that directly follows this fragment is the bundle ID of the required app.

     To get the bundle ID of an app that has been added to Kaspersky Security Center:

     1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
     2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

     In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

     If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

   • Operating system version

     Checks the version of the operating system on the device.

     For this criterion, you need to select a comparison operator (Equal to, Not equal to, Less than, Less than or equal to, Greater than, or Greater than or equal to) and specify the iOS version.

     Note that the Equal to and Not equal to operators check for a full match of the operating system version with the specified value. For instance, if you specify 15 in the rule, but the device is running iOS 15.2, the Equal to criterion is not met. If you need to specify a range of versions, you can create two criteria and use the Less than and Greater than operators.

   • Management mode

     Checks the device's management mode.

     For this criterion, you need to select a mode (Supervised device or Non-supervised device).

   • Device type

     Checks the device type.

     For this criterion, you need to select a type (iPhone or iPad).

   • Device model

     Checks the device model.

     For this criterion, you need to select an operator (Included in the list or Not included in the list), and then specify models that will be checked or excluded from the check, respectively.

     To specify a model, type at least one character in the Identifier field, and then select the required model from the appeared list. The list contains mobile device codes and their matching product names. For example, if you want to add all iPhone 14 models, type "iPhone 14". In this case, you can select any of the available models: "iPhone 14", "iPhone 14 Plus", "iPhone 14 Pro", "iPhone 14 Pro Max".

     In some cases, the same product name may correspond to several mobile device codes (for example, the "iPhone 7" product name corresponds to two mobile device codes, "iPhone 9.1" and "iPhone 9.3"). Be sure that you select all of the mobile device codes that correspond to the required models.

     If you type a value that is not on the list, nothing will be found. However, you can click the OK button in the field to add the typed value to the criterion.

   • Device is roaming

     Checks whether the device is roaming (if you select True) or not (if you select False).

   • Device password was set

     Checks whether a password is set (if you select True) or not (if you select False).

     If you select True, select whether the device password must match (if you select Matches policy) or must not match (if you select Does not match policy) the settings specified in the Password Settings section.

   • Device free space

     Checks whether the amount of free space on the device becomes less than the threshold that you specify.

     For this criterion, specify the threshold amount of free space, and then select the measurement unit (GB or MB).

   • Device is not encrypted

     Checks whether the device is not encrypted.

     Data encryption is enabled by default on password-locked iOS devices (Settings > Touch ID / Face ID and Password > Enable Password). Also, the hardware encryption on a device must be set to At block and file level (you can check this parameter in the device properties: in the console tree, select Additional > Mobile Device Management > Mobile devices, and then double-click the required device).

   • SIM card has been changed

     Checks whether the device SIM card has been replaced or removed compared to the previous check state.

     You can also enable the check for inserting an additional SIM card.

     On eSIM compatible devices, the non-compliance detection cannot be removed by inserting the previously removed eSIM. This is because the device's operating system recognizes each added eSIM as a new one. In this case, you need to delete the compliance control rule from the policy.

   • Last sync earlier than

     Checks how long ago the device last synchronized with Administration Server.

     For this criterion, specify the maximum time after the last sync, and then select the measurement unit (Hours or Days).

     We do not recommend that you specify a value less than the value of the Updating frequency for information about devices parameter in the iOS MDM Server settings.

   If you specify criteria that contradict each other (for example, Device type is set to iPhone but the list of values of Device model, with the Included in the list operator selected, contains an iPad model), an error message is displayed. You cannot save such a rule.

8. On the Actions tab, specify actions to be performed on the device if all specified non-compliance criteria are detected.

   Actions are performed during the compliance rule check, which happens every 40 minutes, and persist until the next synchronization with the Administration Server. To prevent repeat actions from a single instance of non-compliance, set the Updating frequency for information about devices parameter in the iOS MDM Server settings to 30 minutes.

   Add an action in one of the following ways:

   • Click the Add action button if the action should be taken on the device immediately after non-compliance is detected.
   • Click the Add postponed action button if you want to also set a time period in which the user can fix the non-compliance. If the non-compliance is not fixed within this period, the action is performed on the device.

   The following actions are available:

   • Send email message to user

     The device user is informed about the non-compliance by email.

     For this action, you need to specify the user's email address(es). If necessary, you can edit the default text of the email message.

   • Wipe corporate data

     All installed configuration profiles, provisioning profiles, the iOS MDM profile, and applications for which the Remove together with iOS MDM profile check box has been selected are removed from the device. This action is performed by sending the Wipe corporate data command.

   • Install profile

     The configuration profile is installed on the device. This action is performed by sending the Install profile command.

     For this action, you need to specify the ID of the configuration profile to be installed.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete profile

     The configuration profile is deleted from the device. This action is performed by sending the Remove profile command.

     For this action, you need to specify the ID of the configuration profile to be removed.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete all profiles

     All previously installed configuration profiles are deleted from the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted configuration profiles one by one, by sending the respective command to the device.

   • Update operating system

     The device operating system is updated.

     For this action, you need to select the specific operation (Download and install, Download only, or Install only if you want to install a previously downloaded version) and the iOS version to be downloaded and/or installed.

   • Change Bluetooth settings (supervised only)

     For this action, you need to select whether you want to enable or disable Bluetooth on the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Reset to factory settings

     All data is deleted from the device and the settings are rolled back to their default values.

   • Delete managed app

     For this action, you need to specify the bundle ID of the managed app that you want to delete from the device. An app is considered managed if it has been installed on a device through Kaspersky Security Center. How to get the bundle ID of an app

     To get the bundle ID of a native iPhone or iPad app,

     Follow the instruction in Apple documentation.

     To get the bundle ID of any iPhone or iPad app:

     1. Open App Store.
     2. Find the required app and open its page.

        The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

     3. Copy this identifier (without letters "id").
     4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

        This downloads a text file.

     5. Open the downloaded file and find there the "bundleId" fragment.

     The text that directly follows this fragment is the bundle ID of the required app.

     To get the bundle ID of an app that has been added to Kaspersky Security Center:

     1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
     2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

     In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

     If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete all managed apps

     All managed apps are deleted from the device. An app is considered managed if it has been installed on a device through Kaspersky Security Center.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted apps one by one, by sending the respective command to the device.

   • Delete profile(s) of a specific type

     For this action, you need to select the type of the profile to be deleted from the device (for example, Web Clips or Calendar subscriptions).

     As soon as the non-compliance criteria selected for the rule are no longer detected on the device, the deleted profiles are automatically restored.

   • Change roaming settings

     For this action, you need to select whether you want to enable or disable data roaming on the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   If you specify actions that contradict each other (for example, Enable Bluetooth and Disable Bluetooth at the same time, an error message is displayed. You cannot save such a rule.

9. Click the OK button to save the rule and close the wizard.

   The new rule appears in the list in the Compliance Control rules section.

10. In the Actions when user accounts are disabled in Active Directory section, you can configure the actions to perform on devices when a user account is disabled in Active Directory.

    These parameters require integration with Microsoft Active Directory.

    To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and choose one of the following actions:

    • Wipe corporate data
    • Reset to factory settings

    If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.

11. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

App control

This section contains instructions on how to configure user access to apps on a mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

App control on Android devices

The App Control component allows you to manage apps on Android devices to keep these devices secure.

You can impose restrictions on the user's activity on a device on which blocked apps are installed or required apps are not installed (for example, lock the device). You can impose restrictions using the Compliance Control component. To do so, in the scan rule settings, you must select the Forbidden apps are installed, Apps from forbidden categories are installed, or Not all required apps are installed criterion.

Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure proper functioning of App Control. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time. If this is the case, App Control does not run.

In device owner mode, you have extended control over the device. App Control operates without notifying the device user:

• Required apps are installed automatically in the background. To install apps silently, you need to specify a link to the APK file of the required app in the policy settings.
• Forbidden apps can be deleted from the device automatically. To delete apps silently, you need to select the Delete blocked apps automatically (in device owner mode only) check box in the policy settings.

To configure the settings of app startup on the mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App Control section.
5. In the Operation mode section, select the mode of app startup on the user's mobile device:
   • To allow the user to start all apps except those specified in the list of categories and apps as blocked apps, select the Blocked apps mode. The app will hide blocked app icons.
   • To allow the user to start only apps specified in the list of categories and apps as allowed, recommended, or required apps, select the Allowed apps mode. The app will hide all app icons except those specified in the list of allowed, recommended, or required apps and system apps.
6. If you want Kaspersky Endpoint Security for Android to send data on forbidden apps to the event log without blocking them, select the Do not block forbidden apps, only add a record to the event log check box.

   During the next synchronization of the user's mobile device with the Administration Server, Kaspersky Endpoint Security for Android writes an entry for A forbidden app has been installed in the event log. You can view the Event log on the Events tab in the Administration Server properties or in the local properties of the application.

7. If the device is in device owner mode, select the Delete blocked apps automatically (in device owner mode only) check box to remove forbidden apps from the device in the background without notifying the user.
8. If you want Kaspersky Endpoint Security for Android to block the startup of system apps on the user's mobile device (such as Calendar, Camera, and Settings) in Allowed apps mode, select the Block system apps check box.

   Kaspersky experts recommend against blocking system apps because this could lead to failures in device operation.

9. Create a list of categories and apps to configure startup of apps.

   Mobile app packages previously created in the Kaspersky Security Center can be added to the list. How to get the package name of an app

   To get the package name of an app:

   1. Open Google Play.
   2. Find the required app and open its page.

   The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

   To get the package name of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

   For details on app categories, please refer to the Appendices.

   For a list of the apps that belong to each category, please visit the Kaspersky website.

10. If you want Kaspersky Endpoint Security for Android to create a report on installed apps, in the Report on installed mobile apps block, select the Send data on installed apps check box to send information about apps installed on mobile devices, and specify the following settings if required:
    • To send data about the system apps installed on users' devices to the Administration Server, select the Send data on system apps check box.
    • To send data about the service apps installed on users' devices to the Administration Server, select the Send data on service apps check box.

    If a system app or a service app is configured in the App Control settings, the app data is sent regardless of the state of the Send data on system apps or the Send data on service apps check boxes respectively.

    Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed to a device or removed from it.

11. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

App control on iOS MDM devices

Expand all | Collapse all

Kaspersky Security Center allows you to manage apps on iOS MDM devices to keep these devices secure. You can create a list of apps allowed to be installed on devices and a list of apps prohibited from being displayed and launching on devices.

These restrictions apply only to supervised iOS MDM devices.

Open Restrictions for applications section

To open settings for app restrictions on iOS MDM devices:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Restrictions for applications section.

Restrict app installation

By default, the user can install any apps on the supervised iOS MDM device.

To restrict the apps that can be installed on the device:

1. Select the Allow installation of apps from the list (supervised only) check box.
2. In the table, click Add to add an app to the list.
3. Specify the app's bundle ID. Specify the com.apple.webapp value to allow all web clips. How to get the bundle ID of an app

   To get the bundle ID of a native iPhone or iPad app,

   Follow the instruction in Apple documentation.

   To get the bundle ID of any iPhone or iPad app:

   1. Open App Store.
   2. Find the required app and open its page.

      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

   3. Copy this identifier (without letters "id").
   4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

      This downloads a text file.

   5. Open the downloaded file and find there the "bundleId" fragment.

   The text that directly follows this fragment is the bundle ID of the required app.

   To get the bundle ID of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

4. Click the Apply button to save the changes you have made.

Once the policy is applied to a device, the specified restrictions for apps are configured on the device. Only apps from the list and system apps will be available for installation. All other apps can't be installed on the device.

The specified apps can be installed on the device in the following ways (if the corresponding options are enabled in the Features restrictions section):

• Installation from Apple Configurator or iTunes
• Installation from App Store
• Automatic loading

Specify prohibited apps

By default, all apps can be displayed and launched on the supervised iOS MDM device.

To specify prohibited apps:

1. Select the Prohibit displaying and launching apps from the list (supervised only) check box.
2. In the table, click Add to add an app to the list.
3. Specify the app's bundle ID. Specify the com.apple.webapp value to restrict all web clips. How to get the bundle ID of an app

   To get the bundle ID of a native iPhone or iPad app,

   Follow the instruction in Apple documentation.

   To get the bundle ID of any iPhone or iPad app:

   1. Open App Store.
   2. Find the required app and open its page.

      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

   3. Copy this identifier (without letters "id").
   4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

      This downloads a text file.

   5. Open the downloaded file and find there the "bundleId" fragment.

   The text that directly follows this fragment is the bundle ID of the required app.

   To get the bundle ID of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

4. Click the Apply button to save the changes you have made.

Once the policy is applied to a device, the specified restrictions for apps are configured on the device. Apps from the list will be prohibited from being displayed and launching on the device. All other apps will be displayed and available to run.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Statuses of mobile devices

Mobile device statuses defined by Kaspersky Security Center

Administration Console allows you to quickly assess the current status of Kaspersky Security Center and managed mobile devices by checking traffic lights. The traffic lights are shown in the workspace of the Administration Server node, in the Mobile Device Management folder, in the Mobile devices subfolder. The subfolder workspace displays a table of managed mobile devices.

A traffic light is a colored icon in the Management column of the table. Each traffic light can be any of these colors (see the table Color codes of traffic lights). The color of a traffic light depends on the current status of Kaspersky Security Center and on the events that were logged.

A device can have one of the following statuses: OK, Critical, or Warning.

The statuses are assigned and sent to Kaspersky Security Center, in accordance with the following requirements:

• One reason for status assignment is detected on the device — the device gets the status which is displayed in the list of managed devices.
• Several reasons for status assignment are detected on the device — Kaspersky Secure Mobility Management selects the most critical status and sets it as general.
• No reasons for status assignment are detected on the device — Kaspersky Secure Mobility Management does not send the structure of statuses to Kaspersky Security Center, and the status is set as OK.

  Color codes of traffic lights

  Icon	Status	Traffic light color meaning
  	Light blue Mobile device detected on the network and included in none of the administration groups.	Events have been logged that are unrelated to potential or actual threats to the security of managed devices.
  	Green Mobile device included in an administration group, with the OK status.	Administrator's intervention is required.
  	Yellow Mobile device included in an administration group, with the Warning status.	Events have been logged that are unrelated to potential or actual threats to the security of managed devices.
  	Red Mobile device included in an administration group, with the Critical status.	Serious problems have been encountered. An administrator's intervention is required to solve them.
  	Mobile device included in an administration group, having lost its connection with the Administration Server.	Can be any of the colors: light blue, green, yellow, red.

The administrator's goal is to keep traffic lights green on all of the devices.

You can select Properties from the context menu of the mobile device, and then go to the Protection section to view the logged events that affect traffic lights and the status of Kaspersky Security Center (see the table Name, description, and traffic light colors of logged events).

Name, description, and traffic light colors of logged events

Mobile device statuses defined by Kaspersky Secure Mobility Management

These are additional statues that function together with the statuses defined by Kaspersky Security Center (see the table Name, description, and traffic light colors of logged events).

Kaspersky Secure Mobility Management defines the status of mobile devices, based on the policy settings, and then sends the structure of statuses to Kaspersky Security Center when it is synchronized. The administrator can change the device status in the policy, depending on the severity level of the condition (see the table Default values, reasons, and conditions for status assignment). In this case, the value set by the administrator overrides the default value defined by Kaspersky Secure Mobility Management.

Default values, reasons, and conditions for status assignment

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Software inventory on Android devices

You can inventory apps on Android devices connected to Kaspersky Security Center. Kaspersky Endpoint Security for Android receives information about all apps installed on mobile devices. Information acquired during inventory is displayed in the device properties in the Events section. You can view detailed information on each installed app, including its version and publisher.

To enable software inventory:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App Control section.
5. In the Software inventory section, select the Send data on installed apps check box.
6. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed or removed from the device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring the display of Android devices in Kaspersky Security Center

For convenient operations with the list of mobile devices, you should configure the settings for displaying devices in Kaspersky Security Center. By default, the list of mobile devices is displayed in the Additional → Mobile Device Management → Mobile devices console tree. Device information is updated automatically. You can also manually update the list of mobile devices by clicking the Update button in the upper right corner.

After connecting the device to Kaspersky Security Center, devices are added to the mobile device list automatically. The mobile device list may contain detailed information about that device: model, operation system, IP address, and others.

You can configure the device name format and select the device status. The device status informs you about how the components of Kaspersky Endpoint Security for Android are operating on the user's mobile device.

Kaspersky Endpoint Security for Android components could be non-operational for the following reasons:

• The user disabled the component in the device settings.
• The user did not grant the app the necessary permissions for the component to operate (for example, there is no permission to determine the device location for the corresponding Anti-Theft command).

To display the device status, you must enable the Determined by the application condition in the administration group properties (Properties > Device status > Set device status to Critical if and Set device status to Warning if). In the administration group properties, you can also select other criteria for forming the mobile device status.

To configure the display of Android devices in Kaspersky Security Center:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device information section.
5. In the Device name in Kaspersky Security Center section, select the device name format for the device name in the Administration Console:
   • Device model [email, device ID]
   • Device model [email (if any) or device ID]

   A device ID is a unique ID that Kaspersky Endpoint Security for Android generates from the data received from a device as follows:

   • On personal devices running Android 9 and earlier, the app uses the IMEI. For later versions of Android, the app uses SSAID (Android ID) or checksum of other data received from the device.
   • In device owner mode, the app uses IMEI on all Android versions.
   • When a work profile is created on devices running Android 11 or earlier, the app uses IMEI. On other Android versions, the app uses the SSAID (Android ID) or checksum of other data received from the device.
6. Set the Lock attribute in the locked position ().
7. In the Device status in Kaspersky Security Center section, select the appropriate device status if a component of Kaspersky Endpoint Security for Android is not working: (Critical), (Warning) or (OK).

   In the list of mobile devices, the device status will be changed according to the selected status.

8. Set the Lock attribute in the locked position.
9. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Protection

This section contains information about how to remotely manage protection of mobile devices in the Administration Console of Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring anti-malware protection on Android devices

For the timely detection of threats, viruses, and other malicious applications, you should configure the settings for real-time protection and autorun of malware scans.

Kaspersky Endpoint Security for Android detects the following types of objects:

• Viruses, worms, Trojans, and malicious tools
• Adware
• Apps that can be exploited by criminals to harm your device or personal data

Anti-Malware has a number of limitations:

• When Anti-Malware is running, a threat detected in the external memory of the device (such as an SD card) cannot be neutralized automatically in the Work profile (Applications with a briefcase icon, Configuring the Android work profile). Kaspersky Endpoint Security for Android does not have access to external memory in the Work profile. Information about detected objects is displayed in app notifications. To neutralize objects detected in the external memory, the object files have to be deleted manually and the device scan restarted.
• Due to technical limitations, Kaspersky Endpoint Security for Android cannot scan files with a size of 2 GB or more. During a scan, the app skips such files without notifying you that such files were skipped.
• On devices running Android 11 or later, the Kaspersky Endpoint Security for Android app can't scan the "Android/data" and "Android/obb" folders and detect malware in them due to technical limitations.

To configure the mobile device real-time protection settings:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Protection section.
5. In the Protection section, configure the settings of mobile device file system protection:
   • To enable real-time protection of the mobile device against threats, select the Enable Protection check box.

     Kaspersky Endpoint Security for Android scans only new apps and files from the Downloads folder.

   • To enable extended protection of the mobile device against threats, select the Extended protection mode check box.

     Kaspersky Endpoint Security for Android will scan all files that the user opens, modifies, moves, copies, installs or saves on the device, as well as newly installed mobile apps.

     On devices running Android 8.0 or later, Kaspersky Endpoint Security for Android scans files that the user modifies, moves, installs and saves, as well as copies of files. Kaspersky Endpoint Security for Android does not scan files when they are opened, or source files when they are copied.

   • To enable additional scanning of new apps before they are started for the first time on the user's device with the help of the Kaspersky Security Network cloud service, select the Cloud protection (KSN) check box.
   • To block adware and apps that can be exploited by criminals to harm the device or user data, select the Detect adware, autodialers, and riskware check box.
6. In the Action on threat detection list, select one of the following options:
   • Delete

     Detected objects will be automatically deleted. The user is not required to take any additional actions. Prior to deleting an object, Kaspersky Endpoint Security for Android will display a temporary notification about the detection of the object.

   • Skip

     If the detected objects have been skipped, Kaspersky Endpoint Security for Android warns the user about problems in device protection. For each skipped threat, the app provides actions that the user can perform to eliminate the threat. The list of skipped objects may change, for example, if a malicious file was deleted or moved. To receive an up-to-date list of threats, run a full device scan. To ensure reliable protection of your data, eliminate all detected objects.

   • Quarantine
7. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

To configure autorun of malware scans on the mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Scan section.
5. To block adware and apps that can be exploited by criminals to harm the device or user data, select the Detect adware, autodialers, and riskware check box.
6. In the Action on threat detection list, select one of the following options:
   • Delete

     Detected objects will be automatically deleted. The user is not required to take any additional actions. Prior to deleting an object, Kaspersky Endpoint Security for Android will display a temporary notification about the detection of the object.

   • Skip

     If the detected objects have been skipped, Kaspersky Endpoint Security for Android warns the user about problems in device protection. For each skipped threat, the app provides actions that the user can perform to eliminate the threat. The list of skipped objects may change, for example, if a malicious file was deleted or moved. To receive an up-to-date list of threats, run a full device scan. To ensure reliable protection of your data, eliminate all detected objects.

   • Quarantine
   • Ask user

     The Kaspersky Endpoint Security for Android app displays a notification prompting the user to choose the action to take on the detected object: Skip or Delete.

     When the app detects several objects, the Ask user option allows the device user to apply a selected action to each file by using the Apply to all threats check box.

     Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure the display of notifications on mobile devices running Android 10 or later. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time. In this case, Kaspersky Endpoint Security for Android displays an Android system window prompting the user to choose the action to take on the detected object: Skip or Delete. To apply an action to multiple objects, you need to open Kaspersky Endpoint Security.

   If during a scan Kaspersky Endpoint Security for Android detects malicious apps on users' devices, the actions differ depending on the device management mode.

   In device owner mode, installed malicious apps detected by Kaspersky Endpoint Security for Android are deleted from the device automatically, if the Delete option is selected. If Kaspersky Endpoint Security for Android detects malicious system apps, they are prohibited from being displayed and launched on users' devices.

   In Android work profile, installed malicious apps detected by Kaspersky Endpoint Security for Android are not deleted but prohibited from being displayed and launched on users' devices without notifying device users.

   However, if the Ask user option is selected, Kaspersky Endpoint Security for Android prompts users to select an action for each detected app both on devices in device owner mode or with created Android work profile.

   Installed malicious apps cannot be saved in quarantine. So, if the Quarantine option is selected, a detected malicious app is deleted.

   On personal devices, detected malicious apps cannot be deleted automatically. In this case, Kaspersky Endpoint Security for Android prompts the user to delete or skip the detected app.

7. The Scheduled scan section lets you configure the settings of the automatic launch of the full scan of the device file system. To do so, click the Schedule button and specify the frequency and start time of the full scan in the Schedule window.

   If the device is in battery saver mode, the app may perform this task later than specified. To ensure timely responses of KES devices on Android to the administrator's commands, enable the use of Google Firebase Cloud Messaging.

8. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android scans all files, including the contents of archives.

To keep mobile device protection up to date, configure the anti-malware database update settings.

By default, anti-malware database updates are disabled for when the device is roaming. Scheduled updates of anti-malware databases are not performed.

To configure the settings of anti-malware database updates:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Database update section.
5. If you want Kaspersky Endpoint Security for Android to download database updates according to the update schedule when the device is in the roaming zone, select the Allow database update while roaming check box in the Database update while roaming section.

   Even if the check box is cleared, the user can manually start an anti-malware database update when the device is roaming.

6. In the Database update source section, specify the update source from which Kaspersky Endpoint Security for Android receives and installs anti-malware database updates:
   • Kaspersky servers

     Using a Kaspersky update server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices. To update databases from Kaspersky servers, Kaspersky Endpoint Security for Android transmits data to Kaspersky (for example, the update task run ID). The list of data that is transmitted during database updates is provided in the End User License Agreement.

   • Administration Server

     Using the repository of Kaspersky Security Center Administration Server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices.

   • Other source

     Using a third-party server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices. To start an update, you should enter the address of an HTTP server in the field below (e.g., http://domain.com/).

7. In the Scheduled database update section, configure the settings for automatic anti-malware database updates on the user's device. To do so, click the Schedule button and specify the frequency and start time of updates in the Schedule window.

   If the device is in battery saver mode, the app may perform this task later than specified. To ensure timely responses of KES devices on Android to the administrator's commands, enable the use of Google Firebase Cloud Messaging.

8. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Protecting Android devices on the internet

To protect the personal data of a mobile device user on the internet, enable Web Protection. Web Protection blocks malicious websites that distribute malicious code, and phishing websites designed to steal your confidential data and gain access to your financial accounts. Web Protection scans websites before you open them using the Kaspersky Security Network cloud service. Web Protection also lets you configure a user's access to websites based on predefined lists of allowed and blocked websites.

Kaspersky Endpoint Security for Android must be set as an Accessibility feature. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time.

Web Protection on Android devices is supported only by Google Chrome, HUAWEI Browser, Samsung Internet Browser, and Yandex Browser.

If the Kaspersky Endpoint Security for Android app in device owner mode is not enabled as an Accessibility Features service, Web Protection is supported only by the Google Chrome browser and checks only the domain of a website. To allow other browsers (Samsung Internet Browser, Yandex Browser, and HUAWEI Browser) support Web Protection, enable Kaspersky Endpoint Security as an Accessibility Features service. This will also enable the Custom Tabs feature operation.

The Custom Tabs feature is supported by Google Chrome, HUAWEI Browser, and Samsung Internet Browser.

Web Protection for HUAWEI Browser, Samsung Internet Browser, and Yandex Browser does not block sites on a mobile device if a work profile is used and Web Protection is enabled only for the work profile.

To enable Web Protection in Google Chrome, HUAWEI Browser, Samsung Internet Browser, or Yandex Browser:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Web Protection.
5. To use Web Protection, you or device user must read and accept the Statement regarding data processing for the purpose of using Web Protection (Web Protection Statement):
   1. Click the Web Protection Statement link at the top of the section.

      This opens Statement regarding data processing for purpose of using Web Protection window.

   2. Read and accept Privacy Policy by selecting the corresponding check box. To view Privacy Policy, click the Privacy Policy link.

      If you do not accept Privacy Policy, mobile device user can accept Privacy Policy in the Initial Configuration Wizard or in the app ( → About → Terms and conditions → Privacy Policy).

   3. Select the Web Protection Statement acceptance mode:
      • I have read and accept the Web Protection Statement
      • Request acceptance of the Web Protection Statement from the device user
      • I do not accept the Web Protection Statement

        If you select I do not accept the Web Protection Statement, the Web Protection does not block sites on a mobile device. Mobile device user cannot enable Web Protection in the Kaspersky Endpoint Security.

   4. Click OK to close the window.
6. Select the Enable Web Protection check box.
7. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Protection of stolen or lost device data

This section describes how you can configure the unauthorized access protection settings on the device in case it gets lost or stolen.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Sending commands to a lost or stolen mobile device

To protect data on a mobile device that is lost or stolen, you can send special commands.

You can send commands to the following types of managed mobile devices:

• Android devices managed via the Kaspersky Endpoint Security for Android app
• iOS MDM devices

Each device type supports a dedicated set of commands (see the tables below).

Commands for Android devices

Commands for protecting data on a lost or stolen Android device

Commands for iOS MDM devices

Commands for protecting data on a lost or stolen iOS MDM device

Special rights and permissions are required for the execution of commands of Kaspersky Endpoint Security for Android. When the Initial Configuration Wizard is running, Kaspersky Endpoint Security for Android prompts the user to grant the application all required rights and permissions. The user can skip these steps or disable these permissions in the device settings at a later time. If this is the case, it will be impossible to execute commands.

On devices running Android 10 or later, the user must grant the "All the time" permission to access the location. On devices running Android 11 or later, the user must also grant the "While using the app" permission to access camera. Otherwise, Anti-Theft commands will not function. The user will be notified of this limitation and will again be prompted to grant the permissions of required level. If the user selects the "Only this time" option for the camera permission, access is considered granted by the app. It is recommended to contact the user directly if the Camera permission is requested again.

For the complete list of available commands, please refer to the "Commands for mobile devices" section. To learn more about sending commands from Administration Console, please refer to the "Sending commands" section.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Unlocking a mobile device

You can unlock a mobile device by using the following methods:

• Send the mobile device unlock command.
• Enter the one-time unlock code on the mobile device (only for Android devices).

On certain devices (for example, HUAWEI, Meizu, and Xiaomi), you must manually add Kaspersky Endpoint Security for Android to the list of apps that are started when the operating system starts. If the app is not added to the list, you can unlock the device only by using a one-time unlock code. You cannot use commands to unlock the device.

To learn more about sending commands from the list of mobile devices in Administration Console, please refer to the "Sending commands" section.

A one-time unlock code is a secret application code for unlocking the mobile device. The one-time code is generated by the application and is unique to each mobile device. You can change the length of the one-time code (4, 8 or 16 digits) in group policy settings in the Anti-Theft section.

To unlock the mobile device using a one-time code:

1. In the console tree, select Mobile Device Management → Mobile devices.
2. Select a mobile device for which you want to get a one-time unlock code.
3. Open the mobile device properties window by double-clicking.
4. Select Apps → Kaspersky Endpoint Security for Android.
5. Open the Kaspersky Endpoint Security properties window by double-clicking.
6. Select the Anti-Theft section.
7. A unique code for the selected device is shown in the One-time code field of the One-time device unlock code section.
8. Use any available method (such as email) to communicate the one-time code to the user of the locked device.
9. The user enters the one-time code on the screen of the device that is locked by Kaspersky Endpoint Security for Android.

The mobile device is unlocked.

After unlocking a device running Android 5.0 – 6, the screen unlock password is reset to "1234". After unlocking a device running Android 7.0 or later, the screen unlock password is not changed.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Data encryption

To protect data against unauthorized access, you must enable encryption of all data on the device (for example, account credentials, external devices and apps, as well as email messages, SMS messages, contacts, photos, and other files). For access to encrypted data, you must specify a special key – device unlock password. If data is encrypted, access to it can be obtained only when the device is unlocked.

Data encryption is enabled by default on password-locked iOS devices (Settings > Touch ID / Face ID and Password > Enable Password). Also, the hardware encryption on a device must be set to At block and file level (you can check this parameter in the device properties: in the console tree, select Additional > Mobile Device Management > Mobile devices, and then double-click the required device).

To encrypt all data on an Android device:

1. Enable screen lock on the Android device (Settings → Security → Screen lock).
2. Set a device unlock password that is compliant with corporate security requirements.

   It is not recommended to use a pattern lock for unlocking the device. On certain Android devices running Android 6 or later, after encrypting data and restarting the Android device, you must enter a numeric password to unlock the device instead of a pattern lock. This issue is related to the operation of the Accessibility Features service. To unlock the device screen in this case, convert the pattern lock into a numeric password. For more details about converting a pattern lock into a numeric password, please refer to the Technical Support website of the mobile device manufacturer.

3. Enable encryption of all data on the device (Settings → Security → Encrypt data).

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Deleting data on Android devices after failed password entry attempts

You can configure deleting all data on an Android device (that is, resetting the device to factory settings) after the user makes too many failed attempts to enter the screen unlock password.

These settings apply to devices operating in device owner mode and to personal devices on which the Kaspersky Endpoint Security for Android app is enabled as a device administrator.

To configure wiping all data:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Anti-Theft section.
5. In the Data wipe on device section, select the Wipe all data after failed attempts to enter unlock password check box.
6. In the Maximum number of attempts to enter unlock password field, specify the number of attempts that the user can make to unlock the device. The default value is 8. The maximum available value is 20.
7. Click the Apply button to save the changes you have made.

Mobile device settings are configured after the next device synchronization with Kaspersky Security Center. If the user exceeds the specified number of attempts to enter the correct screen unlock password, the Kaspersky Endpoint Security for Android app wipes all device data.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring device unlock password strength

To protect access to a user's mobile device, you should set a device unlock password.

This section contains information about how to configure password protection on Android and iOS devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring a strong unlock password for an Android device

Expand all | Collapse all

To keep an Android device secure, you need to configure the use of a password for which the user is prompted when the device comes out of sleep mode.

You can impose restrictions on the user's activity on the device if the unlock password is weak (for example, lock the device). You can impose restrictions using the Compliance Control component. To do this, in the scan rule settings, you must select the Unlock password is not compliant with security requirements criterion.

On certain Samsung devices running Android 7.0 or later, when the user attempts to configure unsupported methods for unlocking the device (for example, a graphical password), the device may be locked if the following conditions are met: Kaspersky Endpoint Security for Android removal protection is enabled and screen unlock password strength requirements are set. To unlock the device, you must send a special command to the device.

To configure the use of an unlock password:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device Management section.
5. If you want the app to check whether an unlock password has been set, select the Require to set screen unlock password check box in the Screen lock section.

   If the application detects that no system password has been set on the device, it prompts the user to set it. The password is set according to the parameters defined by the administrator.

6. Specify the following options, if required:
   • Minimum number of characters

     The minimum number of characters in the user password. Possible values: 4 to 16 characters.

     The user's password is 4 characters long by default.

     The following is applicable only to personal and work profiles:

     • In personal profile, Kaspersky Endpoint Security resolves the password strength requirements into one of the system values: medium or high on devices running Android 10 or later.
     • In work profile, Kaspersky Endpoint Security resolves the password strength requirements into one of the system values: medium or high on devices running Android 12 or later.

     The values are determined by the following rules:

     • If the password length required is 1 to 4 symbols, then the app prompts the user to set a medium-strength password. It must be either numeric (PIN) with no repeating or ordered (e.g. 1234) sequences, or alphabetic/ alphanumeric. The PIN or password must be at least 4 characters long.
     • If the password length required is 5 or more symbols, then the app prompts the user to set a high-strength password. It must be either numeric (PIN) with no repeating or ordered sequences, or alphabetic/ alphanumeric (password). The PIN must be at least 8 digits long; the password must be at least 6 characters long.
   • Minimum password complexity requirements (Android 12 or earlier in device owner mode)

     Specifies minimum unlock password requirements. These requirements apply only to new user passwords. The following values are available:

     • Numeric

       The user can set a password that includes numbers or set any stronger password (for instance, alphabetic or alphanumeric).

       This option is selected by default.

     • Alphabetic

       The user can set a password that includes letters (or other non-number symbols) or set any stronger password (for instance, alphanumeric).

     • Alphanumeric

       The user can set a password that includes both numbers and letters (or other non-number symbols) or set any stronger complex password.

     • Not specified

       The user can set any password.

     • Complex

       The user must set a complex password according to the specified password properties:

       • Minimum number of letters
       • Minimum number of digits
       • Minimum number of special symbols (for example, !@#$%)
       • Minimum number of uppercase letters
       • Minimum number of lowercase letters
       • Minimum number of non-letter characters (for example, 1^&*9)
     • Complex numeric

       The user can set a password that includes numbers with no repetitions (e.g. 4444) and no ordered sequences (e.g. 1234, 4321, 2468) or set any stronger complex password.

     • Weak biometric

       The user can use biometric unlock methods or set a stronger complex password.

     This option applies only to devices running Android 12 or later in device owner mode.

   • Maximum password age, in days

     Specifies the number of days before the password expires. Applying a new value will set the current password lifetime to the new value.

     The default value is 0. This means that the password won't expire.

     This settings applies to devices running all supported Android versions. Starting from Android 10, this setting applies only to the device owner mode.

   • Number of days to notify that a password change is required (for device owner mode)

     Specifies the number of days to notify the user before the password expires.

     The default value is 0. This means that the user won't be notified about password expiration.

     This option applies only to devices operating in device owner mode.

   • Number of recent passwords that can't be used as a new password (all Android versions; Android 10 or later in device owner mode)
   • Period of inactivity before the device screen locks, in seconds

     Specifies the period of inactivity before the device locks. After this period, the device will lock.

     The default value is 0. This means that the device won't lock after a certain period.

   • Period after unlocking by biometric methods before entering a password, in minutes (Android 8.0 or later in device owner mode)

     Specifies the period for unlocking the device without a password. During this period, the user can use biometric methods to unlock the screen. After this period, the user can unlock the screen only with a password.

     The default value is 0. This means that the user won't be forced to unlock the device with a password after a certain period.

     This option applies only to devices running Android 8.0 or later in device owner mode.

   • Allow biometric unlock methods (Android 9 or later; Android 10 in device owner mode)

     If the check box is selected, the use of biometric unlock methods on the mobile device is allowed.

     If the check box is cleared, Kaspersky Endpoint Security for Android blocks the use of biometric methods to unlock the screen. The user can unlock the screen only with a password.

     This check box is selected by default.

     This setting applies only to devices running Android 9 or later. Starting from Android 10, this setting applies only to the device owner mode.

   • Allow use of fingerprints (all Android versions; Android 10 in device owner mode)

     The use of fingerprints to unlock the screen.

     This check box does not restrict the use of a fingerprint scanner when signing in to apps or confirming purchases.

     If the check box is selected, the use of fingerprints on the mobile device is allowed.

     If the check box is cleared, Kaspersky Endpoint Security for Android blocks the use of fingerprints to unlock the screen. The user can unlock the screen only with a password. In the Android settings, the option to use fingerprints will be unavailable (Android Settings > Security > Screen lock > Fingerprints).

     This check box is available only if the Allow biometric unlock methods (Android 9 or later; Android 10 or later in device owner mode) check box is selected.

     This check box is selected by default.

     This settings applies to devices running all supported Android versions. Starting from Android 10, this setting applies only to the device owner mode.

     On some Xiaomi devices with Android work profile, the work profile may be unlocked by a fingerprint only if you set the Period of inactivity before the device screen locks value after setting a fingerprint as the screen unlocking method.

   • Allow face scanning (Android 9 or later; Android 10 in device owner mode)
   • Allow iris scanning (Android 9 or later; Android 10 in device owner mode)

     If the check box is selected, the use of iris scanning on the mobile device is allowed.

     If the check box is cleared, Kaspersky Endpoint Security for Android blocks the use of iris scanning to unlock the screen.

     This check box is available only if the Allow biometric unlock methods (Android 9 or later; Android 10 or later in device owner mode) check box is selected.

     This check box is selected by default.

     This setting applies only to devices running Android 9 or later. Starting from Android 10, this setting applies only to the device owner mode.

   • Allow the device to start up before prompting the password

     If the check box is selected, the device starts up and loads system processes and background apps before prompting the user to enter the unlock password.

     Once this option is applied, it cannot be reverted without resetting the device to factory defaults.

     If the check box is cleared, the startup requirements remain unchanged.

     This check box is cleared by default.

   • Unlock password

     This option lets you set the password on the user device.

     On devices running Android 7.0–10 inclusive, this option applies to personal devices on which no password is set.

     On devices running Android 11 or later, this option applies only if the device is in device owner mode.

     Once you save the policy, this option applies to the device by sending a command with the specified password. The input is cleared and the specified password is not saved in Administration Console.

     • If the device is not protected with the password or is running Android 10 or earlier, Kaspersky Endpoint Security for Android sets the password immediately.
     • If the device is running Android 11 or later, Kaspersky Endpoint Security for Android prompts the user to apply the new password.

     If you leave this option empty, no changes are applied to the device.

7. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

On some HUAWEI devices, an issue message about too simple screen unlocking method appears.

To set a correct PIN code on a HUAWEI device, the user must do the following:

1. In the issue message, tap the Edit button.
2. Enter the current PIN code.
3. In the Set new password window, tap the Change unlock method button.
4. Select the Custom PIN unlock method.
5. Set the new PIN code.

   The PIN code must be compliant with policy requirements.

A correct PIN code is now set on the device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring a strong unlock password for iOS MDM devices

To protect iOS MDM device data, configure the unlock password strength settings.

By default, the user can use a simple password. A simple password is a password that contains successive or repetitive characters, such as "abcd" or "2222". The user is not required to enter an alphanumeric password that includes special symbols. By default, the password validity period and the number of password entry attempts are not limited.

To configure the strength settings for an iOS MDM device unlock password:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Password section.
5. In the Password settings section, select the Apply settings on device check box.
6. Configure unlock password strength settings:
   • To allow the user to use a simple password, select the Allow simple password check box.
   • To require use of both letters and numbers in the password, select the Prompt for alphanumeric value check box.
   • To require use of a password, select the Force use of password check box. If the check box is cleared, the mobile device can be used without a password.
   • In the Minimum password length list, select the minimum password length in characters.
   • In the Minimum number of special characters list, select the minimum number of special characters in the password (such as "$", "&", "!").
   • In the Maximum password lifetime field, specify the period of time in days during which the password will stay current. When this period expires, Kaspersky Device Management for iOS prompts the user to change the password.
   • In the Enable Auto-Lock in list, select the amount of time after which iOS MDM device Auto-Lock should be enabled.
   • In the Password history field, specify the number of used passwords (including the current password) that Kaspersky Device Management for iOS will compare with the new password when the user changes the old password. If passwords match, the new password is rejected.
   • In the Maximum time for unlock without password list, select the amount of time during which the user can unlock the iOS MDM device without entering the password.
   • In the Maximum number of access attempts, select the number of access attempts that the user can make to enter the iOS MDM device unlock password.
7. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, Kaspersky Device Management for iOS checks the strength of the password set on the user's mobile device. If the strength of the device unlock password does not conform to the policy, the user is prompted to change the password.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring a virtual private network (VPN)

This section contains information on configuring virtual private network (VPN) settings for secure connection to Wi-Fi networks.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring VPN on Android devices (only Samsung)

To securely connect an Android device to Wi-Fi networks and protect data transfer, you should configure the settings for VPN (Virtual Private Network).

Configuration of VPN is possible only for Samsung devices running Android 11 or earlier.

The following requirements should be considered when using a virtual private network:

• The app that uses the VPN connection must be allowed in Firewall settings.
• Virtual private network settings configured in the policy cannot be applied to system applications. The VPN connection for system applications has to be configured manually.
• Some applications that use the VPN connection need to have additional settings configured at first startup. To configure settings, the VPN connection has to be allowed in application settings.

To configure VPN on a user's mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Manage Samsung KNOX → Manage Samsung devices section.
5. In the VPN section, click the Configure button.

   This opens the VPN network window.

6. In the Connection type drop-down list, select the type of VPN connection.
7. In the Network name field, enter the name of the VPN tunnel.
8. In the Server address field, enter the network name or IP address of the VPN server.
9. In the DNS search domain(s) list, enter the DNS search domain to be automatically added to the DNS server name.

   You can specify several DNS search domains, separating them with blank spaces.

10. In the DNS server(s) field, enter the full domain name or IP address of the DNS server.

    You can specify several DNS servers, separating them with blank spaces.

11. In the Routing field, enter the range of network IP addresses with which data is exchanged via the VPN connection.

    If the range of IP addresses is not specified in the Routing field, all internet traffic will pass through the VPN connection.

12. Additionally configure the following settings for networks of the IPSec Xauth PSK and L2TP IPSec PSK types:
    1. In the IPSec shared key field, enter the password for the preset IPSec security key.
    2. In the IPSec ID field, enter the name of the mobile device user.
13. For an L2TP IPSec PSK network, additionally specify the password for the L2TP key in the L2TP key field.
14. For a PPTP network, select the Use SSL connection check box so that the app will use the MPPE (Microsoft Point-to-Point Encryption) method of data encryption to secure data transmission when the mobile device connects to the VPN server.
15. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring VPN on iOS MDM devices

To connect an iOS MDM device to a virtual private network (VPN) and protect data during the connection to the VPN, configure the VPN connection settings. The IKEv2 and IPSec VPN protocols also let you set up a VPN connection for selected website domains in Safari.

To configure the VPN connection on a user's iOS MDM device:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the VPN section.
5. Click the Add button in the VPN networks section.

   This opens the VPN network window.

6. In the Network name field, enter the name of the VPN tunnel.
7. In the Connection type drop-down list, select the type of VPN connection:
   • L2TP (Layer 2 Tunneling Protocol). The connection supports authentication of iOS MDM device user using MS-CHAP v2 passwords, two-factor authentication, and automatic authentication using a public key.
   • PPTP (Point-to-Point Tunneling Protocol). The connection supports authentication of iOS MDM device user using MS-CHAP v2 passwords and two-factor authentication.

     The PPTP connection is no longer supported.

   • IKEv2 (Internet Key Exchange version 2). The connection establishes the Security Association (SA) attribute between two network entities and supports authentication using EAP (Extensible Authentication Protocols), shared secrets, and certificates.
   • IPSec (Cisco). The connection supports password-based user authentication, two-factor authentication, and automatic authentication using a public key and certificates.
   • Cisco AnyConnect. The connection supports the Cisco Adaptive Security Appliance (ASA) firewall of version 8.0(3).1 or later. To configure the VPN connection, install the Cisco AnyConnect app from App Store on the iOS MDM device.
   • Juniper SSL. The connection supports the Juniper Networks SSL VPN gateway, Series SA, of version 6.4 or later with the Juniper Networks IVE package of version 7.0 or later. To configure the VPN connection, install the JUNOS app from App Store on the iOS MDM device.
   • F5 SSL. The connection supports F5 BIG-IP Edge Gateway, Access Policy Manager, and Fire SSL VPN solutions. To configure the VPN connection, install the F5 BIG-IP Edge Client app from App Store on the iOS MDM device.
   • SonicWALL Mobile Connect. The connection supports SonicWALL Aventail E-Class Secure Remote Access devices of version 10.5.4 or later, SonicWALL SRA devices of version 5.5 or later, as well as SonicWALL Next-Generation Firewall devices, including TZ, NSA, E-Class NSA with SonicOS of version 5.8.1.0 or later. To configure the VPN connection, install the SonicWALL Mobile Connect app from App Store on the iOS MDM device.
   • Aruba VIA. The connection supports Aruba Networks mobile access controllers. To configure them, install the Aruba Networks VIA app from App Store on the iOS MDM device.
   • Custom SSL. The connection supports authentication of the iOS MDM device user using passwords and certificates and two-factor authentication.
8. In the Server address field, enter the network name or IP address of the VPN server.
9. In the Account name field, enter the account name for authorization on the VPN server. You can use macros from the Macros available drop-down list.
10. Configure the security settings for the VPN connection according to the selected type of virtual private network. For information about these settings, refer to the context help of the administration plug-in.
11. For IKEv2 and IPsec connections, if necessary, set up Per App VPN functionality for supported system apps (Email, Calendar, Safari, and Contacts). For details, refer to the Configuring Per App VPN on iOS MDM devices section or the context help of the administration plug-in.
12. If necessary, configure the settings of the VPN connection via a proxy server:
    1. Select the Proxy server settings tab.
    2. Select the proxy server configuration mode and specify the connection settings.
    3. Click OK.

    As a result, the settings of the device connection to a VPN via a proxy server are configured on the iOS MDM device.

13. Click OK.

    The new VPN is displayed in the list.

14. Click the Apply button to save the changes you have made.

As a result, a VPN connection will be configured on the user's iOS MDM device once the policy is applied.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring Per App VPN on iOS MDM devices

The Per App VPN functionality allows a device to establish a VPN connection when supported system apps (Email, Calendar, Safari, and Contacts) are launched. This functionality is available for IKEv2 and IPsec connections.

To enable the Per App VPN functionality:

1. Perform the initial setup of the VPN connection. For more details on the pre-configuring process, please refer to the Configuring VPN on iOS MDM devices section.
2. Select the Enable Per App VPN check box.

Set up Per App VPN for supported system apps (Email, Calendar, Safari, and Contacts) in the corresponding policy sections.

When you select the Enable Per App VPN check box, the Turn on VPN automatically for system apps check box becomes available and is also selected. This means that the device will automatically activate the VPN connection when associated system apps initiate network communication.

To specify the Per App VPN configuration for the Email, Calendar, and Contacts apps:

1. Go to the corresponding policy section.
2. Click Add to create a new account or select the existing account in the list and click Edit.
3. In the Per App VPN settings section, select the Enable Per App VPN (iOS 14+) check box.
4. Choose this Per App VPN configuration from the Select Per App VPN configuration drop-down list and click OK to save the changes.

To specify the Per App VPN configuration for Safari:

1. Go to the Safari policy section.
2. Click Add.

   The Adding domain for Safari window opens.

3. Choose this Per App VPN configuration from the Per App VPN configuration drop-down list.
4. In the Domain for the VPN connection that will be activated field, specify the website domain that will trigger the VPN connection in Safari. The domain should be in the "www.example.com" format.
5. Click OK to add the domain to the list.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring Firewall on Android devices (only Samsung)

Configure Firewall settings to monitor network connections on the user's mobile device.

To configure Firewall on a mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Manage Samsung KNOX → Manage Samsung devices section.
5. In the Firewall window, click Configure.

   The Firewall window opens.

6. Select the Firewall mode:
   • To allow all inbound and outbound connections, move the slider to Allow all.
   • To block all network activity except that of apps on the list of exclusions, move the slider up to Block all but exceptions.
7. If you have set the Firewall mode to Block all but exceptions, create a list of exclusions:
   1. Click Add.

      This opens the Exclusion for Firewall window.

   2. In the App name field, enter the name of the mobile app.
   3. In the Package name field, enter the system name of the mobile app package (for example, com.mobileapp.example).
   4. Click OK.
8. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Protecting Kaspersky Endpoint Security for Android against removal

For mobile device protection and compliance with corporate security requirements, you can enable protection against removal of Kaspersky Endpoint Security for Android. In this case, the user cannot remove the app using the Kaspersky Endpoint Security for Android interface. When removing the app using the tools of the Android operating system, you are prompted to disable administrator rights for Kaspersky Endpoint Security for Android. After disabling the rights, the mobile device will be locked.

On certain Samsung devices running Android 7.0 or later, when the user attempts to configure unsupported methods for unlocking the device (for example, a graphical password), the device may be locked if the following conditions are met: Kaspersky Endpoint Security for Android removal protection is enabled and screen unlock password strength requirements are set. To unlock the device, you must send a special command to the device.

To enable protection against removal of Kaspersky Endpoint Security for Android:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Additional section.
5. In the Removal of Kaspersky Endpoint Security for Android section, clear the Allow removal of Kaspersky Endpoint Security for Android check box.

   To protect the app from removal on devices running Android 7.0 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. When the Initial Configuration Wizard is running, Kaspersky Endpoint Security for Android prompts the user to grant the application all required permissions. The user can skip these steps or disable these permissions in the device settings at a later time. If this is the case, the app is not protected from removal.

6. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. If an attempt is made to remove the app, the mobile device will be locked.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Detecting device hacks (root)

Kaspersky Secure Mobility Management enables you to detect device hacks (root). System files are unprotected on a hacked device and can therefore be modified. Moreover, third-party apps from unknown sources could be installed on hacked devices. Upon detection of a hack attempt, we recommend that you immediately restore normal operation of the device.

Kaspersky Endpoint Security for Android uses the following services to detect when a user obtains root privileges:

• Embedded service of Kaspersky Endpoint Security for Android. A Kaspersky service that checks whether a mobile device user has obtained root privileges (Kaspersky Mobile Security SDK).

If the device is hacked, you receive a notification. You can view hacking notifications in the workspace of the Administration Server on the Monitoring tab. You can also disable notifications about hacks in the event notification settings.

On devices running Android, you can impose restrictions on the user's activity on the device if the device is hacked (for example, lock the device). You can impose restrictions by using the Compliance Control component. To do this, in the compliance rule settings, select the Device has been rooted criterion.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring a global HTTP proxy on iOS MDM devices

To protect the user's internet traffic, configure the connection of the iOS MDM device to the internet via a proxy server.

Automatic connection to the internet via a proxy server is available for controlled devices only.

To configure global HTTP proxy settings on the user's iOS MDM device:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Global HTTP Proxy section.
5. In the Global HTTP proxy settings section, select the Apply settings on device check box.
6. Select the type of global HTTP proxy configuration.

   By default, the manual type of global HTTP proxy configuration is selected, and the user is prohibited from connecting to captive networks without connecting to a proxy server. Captive networks are wireless networks that require preliminary authentication on the mobile device without connecting to the proxy server.

   • To specify the proxy server connection settings manually:
     1. In the Proxy settings type drop-down list, select Manual.
     2. In the Proxy server address and port field, enter the name of a host or the IP address of a proxy server and the number of the proxy server port.
     3. In the User name field, set the user account name for proxy server authorization. You can use macros from the Macros available drop-down list.
     4. In the Password field, set the user account password for proxy server authorization.
     5. To allow the user to access captive networks, select the Allow access to captive networks without connecting to proxy check box.
   • To configure the proxy server connection settings using a predefined PAC (Proxy Auto Configuration) file:
     1. In the Proxy settings type drop-down list, select Automatic.
     2. In the URL of PAC file field, enter the web address of the PAC file (for example: http://www.example.com/filename.pac).
     3. To allow the user to connect the mobile device to a wireless network without using a proxy server when the PAC file cannot be accessed, select the Allow direct connection if PAC file cannot be accessed check box.
     4. To allow the user to access captive networks, select the Allow access to captive networks without connecting to proxy check box.
7. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, the mobile device user will connect to the internet via a proxy server.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Adding security certificates to iOS MDM devices

To simplify user authentication and ensure data security, add certificates on the user's iOS MDM device. Data signed with a certificate is protected against modification during network exchange. Data encryption using a certificate provides an added level of security for data. The certificate can be also used to verify the user's identity.

Kaspersky Device Management for iOS supports the following certificate standards:

• PKCS#1 – encryption with a public key based on RSA algorithms.
• PKCS#12 – storage and transmission of a certificate and a private key.

To add a security certificate on a user's iOS MDM device:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Certificates section.
5. Click the Add button in the Certificates section.

   The Certificate window opens.

6. In the File name field, specify the path to the certificate:

   Files of PKCS#1 certificates have the cer, crt, or der extensions. Files of PKCS#12 certificates have the p12 or pfx extensions.

7. Click Open.

   If the certificate is password-protected, specify the password. The new certificate appears in the list.

8. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, the user will be prompted to install certificates from the list that has been created.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Adding a SCEP profile to iOS MDM devices

You have to add a SCEP profile to enable the iOS MDM device user to automatically receive certificates from the Certification Center via the internet. The SCEP profile enables support of the Simple Certificate Enrollment Protocol.

A SCEP profile with the following settings is added by default:

• The alternative subject name is not used for registering certificates.
• Three attempts 10 seconds apart are made to poll the SCEP server. If all attempts to sign the certificate have failed, you have to generate a new certificate signing request.
• The certificate that has been received cannot be used for data signing or encryption.

You can edit the specified settings when adding the SCEP profile.

To add a SCEP profile:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the SCEP section.
5. Click the Add button in the SCEP profiles section.

   The SCEP profile window opens.

6. In the Server web address field, enter the web address of the SCEP server on which the Certification Center is deployed.

   The URL can contain the IP address or the full domain name (FQDN). For example, http://10.10.10.10/certserver/companyscep.

7. In the Name field, enter the name of the Certification Center deployed on the SCEP server.
8. In the Subject field, enter a string with the attributes of the iOS MDM device user that are contained in the X.500 certificate.

   Attributes can contain details of the country (C), organization (O), and common user name (CN). For example: /C=RU/O=MyCompany/CN=User/. You can also use other attributes specified in RFC 5280.

9. In the Type of alternative name of subject drop-down list, select the type of alternative name of the subject of the SCEP server:
   • No – alternative name identification is not used.
   • RFC 822 name – identification using the email address. The email address must be specified according to RFC 822.
   • DNS name – identification using the domain name.
   • URI – identification using the IP address or address in FQDN format.

   You can use an alternative name of the subject for identifying the user of the iOS MDM device.

10. In the Subject Alternative Name field, enter the alternative name of the subject of the X.500 certificate. The value of the subject alternative name depends on the subject type: the user's email address, domain, or web address.
11. In the NT subject name field, enter the DNS name of the iOS MDM device user on the Windows NT network.

    The NT subject name is contained in the certificate request sent to the SCEP server.

12. In the Number of polling attempts on SCEP server field, specify the maximum number of attempts to poll the SCEP server to get the certificate signed.
13. In the Frequency of attempts (sec) field, specify the period of time in seconds between attempts to poll the SCEP server to get the certificate signed.
14. In the Registration request field, enter a pre-published registration key.

    Before signing a certificate, the SCEP server requests the mobile device user to supply a key. If this field is left blank, the SCEP does not request the key.

15. In the Key Size drop-down list, select the size of the registration key in bits: 1024 or 2048.
16. If you want to allow the user to use a certificate received from the SCEP server as a signing certificate, select the Use for signing check box.
17. If you want to allow the user to use a certificate received from the SCEP server for data encryption, select the Use for encryption check box.

    It is prohibited to use the SCEP server certificate as a data signing certificate and a data encryption certificate at the same time.

18. In the Certificate fingerprint field, enter a unique certificate fingerprint for verifying the authenticity of the response from the Certification Center. You can use certificate fingerprints with the SHA1 or MD5 hashing algorithm. You can copy the certificate fingerprint manually or select a certificate using the Create from certificate button. When the fingerprint is created using the Create from certificate button, the fingerprint is added to the field automatically.

    The certificate fingerprint has to be specified if data exchange between the mobile device and the Certification Center takes place via the HTTP protocol.

19. Click OK.

    The new SCEP profile appears in the list.

20. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, the user's mobile device is configured to automatically receive a certificate from the Certification Center via the internet.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Restricting SD card usage (only Samsung)

Expand all | Collapse all

Configure SD card settings to control usage of the SD card on the user's mobile device.

To restrict SD card usage on a mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Manage Samsung KNOX → Manage Samsung devices section.
5. In the SD card settings section specify the needed restrictions:
   • Allow access to SD card

     This setting applies to devices with Android 5.0-12.

     Selecting or clearing this check box specifies whether access to SD card is enabled or disabled on the device.

     This check box is selected by default.

   • Allow writing to SD card

     Selecting or clearing this check box specifies whether writing to SD card is enabled or disabled on the device.

     This check box is selected by default.

   • Allow moving apps to SD card

     Selecting or clearing this check box specifies whether the device user is allowed to move apps to SD card.

     This check box is selected by default.

6. Click the Apply button to save the changes you have made.

SD card settings are now configured.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Management of mobile devices

This section contains information about how to remotely manage mobile devices in the Administration Console of Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Managing KES devices

In Kaspersky Security Center, you can manage KES mobile devices in the following ways:

• Centrally manage KES devices by using commands.
• View information about the settings for management of KES devices.
• Install applications by using mobile app packages.
• Disconnect KES devices from management.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Device owner mode

This section contains information about how to manage the settings of Android mobile devices in device owner mode. For information about device owner mode deployment, see here.

Device owner mode offers the following features and control options for Android mobile devices:

• Restrictions on Android operating system features
• Management of Google Chrome settings
• Silent installation of required apps and removal of blocked apps in App Control
• Kiosk mode
• Management of Exchange ActiveSync for Gmail
• NDES and SCEP integration

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Restricting Android features on devices

Expand all | Collapse all

You can restrict Android operating system features in device owner mode. For example, you can restrict factory reset, changing credentials, use of Google Play and Google Chrome, file transfer over USB, changing location settings, and manage system updates.

You can restrict Android features in the Feature restrictions section.

To open the Feature restrictions section:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device owner mode > Feature restrictions section.

Restrict device features

On the Device Features tab of the Feature restrictions section, you can enable or disable the following features:

• Prohibit factory reset

  Selecting or clearing this check box specifies whether the device user is allowed to perform a factory reset from device settings.

  This check box is cleared by default.

• Prohibit screen sharing, recording, and screenshots

  Selecting or clearing this check box specifies whether the device user is allowed to take screenshots, record and share the device screen. It also specifies whether the contents of the device screen are allowed to be captured for artificial intelligence purposes.

  This check box is cleared by default.

• Prohibit changing language (Android 9 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to change the device language.

  This restriction is supported on devices with Android 9 or later.

  This check box is cleared by default.

  On some devices (for example, Xiaomi, TECNO, and Realme) running Android 9 or later, when you select the Prohibit changing language check box in device owner mode, the user still can change the language, and no warning message appears.

• Prohibit changing date, time, and time zone (Android 9 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to change date, time, and time zone in Settings.

  This restriction is supported on devices with Android 9 or later.

  This check box is cleared by default.

• Prohibit adding and removing Google accounts

  Selecting or clearing the check box specifies whether the device user is allowed to add and remove Google accounts.

  This check box is cleared by default.

• Prohibit adjusting volume and mute device

  Restricts volume adjustment and muting the device.

  If the check box is selected, the device user can't adjust the volume and the device is muted.

  If the check box is cleared, the device user can adjust the volume and the device is unmuted.

  Anti-Theft can play a sound on the device disregarding of this restriction. The restriction is disabled to allow to play the sound, and then re-enabled.

  This check box is cleared by default.

• Prohibit outgoing phone calls

  Selecting or clearing this check box specifies whether the device user is allowed to make outgoing phone calls on this device.

  This check box is cleared by default.

• Prohibit sending and receiving SMS messages

  Selecting or clearing this check box specifies whether the device user is allowed to send and receive SMS messages on this device.

  This check box is cleared by default.

• Prohibit changing credentials

  Selecting or clearing this check box specifies whether the device user is allowed to change user credentials in the operating system.

  This check box is cleared by default.

• Prohibit keyguard camera

  Selecting or clearing the check box specifies whether the device user is prohibited to use camera when the device is locked.

  This check box is cleared by default.

• Prohibit keyguard notifications

  Selecting or clearing the check box specifies whether notifications are prohibited when the device screen is locked.

  This check box is available only if the Prohibit keyguard features check box is selected. Otherwise, the Prohibit keyguard notifications check box is cleared and disabled.

  This check box is cleared by default.

• Prohibit keyguard trust agents

  Selecting or clearing this check box specifies whether trusted apps are prohibited when the device screen is locked. Trusted apps are apps that allow the device user to unlock the device without a password, PIN, or fingerprint.

  This check box is available only if the Prohibit keyguard features check box is selected. Otherwise, the Prohibit keyguard trust agents check box is cleared and disabled.

  This check box is cleared by default.

• Disable keyguard swipe

  Selecting or clearing the check box specifies whether a user's device can be unlocked with a swipe.

  This setting has no effect if a password, PIN-code, or pattern is currently set as an unlocking method on the device.

  This check box is cleared by default.

• Prohibit adjusting brightness (Android 9 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to adjust brightness on the mobile device.

  This restriction is supported on devices with Android 9 or later.

  This check box is cleared by default.

• Prohibit ambient display (Android 9 or later)

  If this option is enabled, the user cannot use the Ambient Display feature on the device.

  By default, the option is disabled.

• Force screen on when plugged in to AC charger (Android 6 or later)

  Selecting or clearing the check box specifies if the device screen will be on while the device is charging with an AC charger.

  The restriction is supported on devices with Android 6 or later.

  This check box is cleared by default.

• Force screen on when plugged in to USB charger (Android 6 or later)

  Selecting or clearing of the check box specifies whether the device screen will be on while the device is charging via a USB charger.

  The restriction is supported on devices with Android 6.0 or later.

  This check box is cleared by default.

• Force screen on when plugged in to wireless charger (Android 6 or later)

  Selecting or clearing this check box specifies whether the device screen will be on while the device is charging via a wireless charger.

  The restriction is supported on devices with Android 6 or later.

  This check box is cleared by default.

• Prohibit changing wallpaper (Android 7.0 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to change the wallpaper on the mobile device.

  This restriction is supported on devices with Android 7.0 or later.

  This check box is cleared by default.

• Prohibit status bar (Android 6 or later)

  Preventing the status bar from being displayed.

  If the check box is selected, the status bar is not displayed on the device. Notifications and quick settings accessible via the status bar are also blocked.

  If the check box is cleared, the status bar can be displayed on the device.

  The restriction is supported on devices with Android 6 or later.

  This check box is cleared by default.

• Prohibit adding users

  Selecting or clearing the check box specifies whether the device user is allowed to add new users.

  This check box is selected by default. If device owner mode was enrolled via a QR code, the restriction is enabled and can't be disabled.

  The restriction can be disabled only on devices that meet the following requirements:

  • The device owner mode was enrolled via the adb.exe installation package.
  • The device must support multiple users.
• Prohibit switching user (Android 9 or later)

  If this option is enabled, the user cannot switch the current user of the device.

  By default, the option is disabled.

• Prohibit removing users

  Selecting or clearing the check box specifies whether the device user is allowed to remove users.

  This check box is selected by default. If device owner mode was enrolled via a QR code, the restriction can't be disabled.

  The restriction can be disabled only on devices that meet the following requirements:

  • The device owner mode was enrolled via the adb.exe installation package.
  • The device must support multiple users.
• Prohibit safe boot (Android 6 or later)

  Selecting or clearing this check box specifies whether the device user is allowed to boot the device in safe mode.

  The restriction is supported on devices with Android 6 or later.

  This check box is cleared by default.

• Prohibit unmuting microphone

  If this option is enabled, the device microphone is muted.

  If this option is disabled, the user can unmute the microphone and adjust its volume.

  By default, the option is disabled.

• Prohibit disabling microphone (Android 12 or later)

  If this option is enabled, the user cannot disable access to the microphone via the system toggle on the device. If access to the microphone on the device is disabled when this option is enabled, it is automatically re-enabled.

  By default, the option is disabled.

  On some Xiaomi and HUAWEI devices running Android 12, this restriction does not work. This issue is caused by the specific features of MIUI firmware on Xiaomi devices and EMUI firmware on HUAWEI devices.

Restrict app features

On the Apps tab of the Feature restrictions section, you can enable or disable the following features:

• Prohibit use of camera

  Selecting or clearing the check box specifies whether the device user is allowed to use all cameras on the device.

  If the check box is selected, our solution usually blocks the camera. However, for Asus and OnePlus devices, the camera app icon is completely hidden when the check box is selected.

  This check box is cleared by default.

• Prohibit camera toggle (Android 12 or later)

  Preventing the device user from toggling the camera.

  If the check box is selected, the device user cannot block the camera access via the system toggle.

  If the check box is cleared, the device user is allowed to use the camera toggle.

  The restriction is supported on devices with Android 12 or later.

  This check box is cleared by default.

  On some Xiaomi and HUAWEI devices running Android 12, this restriction does not work. This issue is caused by the specific features of MIUI firmware on Xiaomi devices and EMUI firmware on HUAWEI devices.

• Prohibit use of Google Play

  Selecting or clearing the check box specifies whether the device user is allowed to use Google Play.

  This check box is cleared by default.

• Prohibit use of Google Chrome

  Preventing use of Google Chrome.

  If the check box is selected, the device user cannot start Google Chrome or configure it in system settings.

  If the check box is cleared, the device user is allowed to use Google Chrome on the device.

  The check box is cleared by default.

• Prohibit use of Google Assistant

  Selecting or clearing the check box specifies whether the device user is allowed to use Google Assistant on the device.

  This check box is cleared by default.

• Prohibit installation of apps from unknown sources

  Selecting or clearing the check box specifies whether the device user is allowed to install apps from unknown sources.

  This check box is cleared by default.

• Prohibit modification of apps in Settings

  Preventing modifying apps in Settings.

  If the check box is selected, the device user is disallowed to perform the following actions:

  • Uninstalling apps
  • Disabling apps
  • Clearing app caches
  • Clearing app data
  • Force stopping apps
  • Clearing app defaults

    If the check box is cleared, the device user is allowed to modify apps in Settings.

    This check box is cleared by default.

• Prohibit installation of apps

  Selecting or clearing the check box specifies whether the device user is allowed to install apps on the device.

  This check box is cleared by default.

• Prohibit uninstallation of apps

  Selecting or clearing the check box specifies whether a device user is allowed to uninstall apps from this device.

  This check box is cleared by default.

• Prohibit disabling app verification

  Selecting or clearing the check box specifies whether the device user is allowed to disable app verification.

  This check box is cleared by default.

• Granting runtime permissions for apps

  The Granting runtime permissions for apps setting allows you to select an action to be performed when apps installed on devices in device owner mode are running and request additional permissions. This does not apply to permissions granted in device Settings (e.g. Access All Files).

  • Prompt the user for permissions

    When a permission is requested, the user decides whether to grant the specified permission to the app.

    This option is selected by default.

  • Grant permissions automatically

    All apps installed on devices in device owner mode are granted permissions without user interaction.

  • Deny permissions automatically

    All apps installed on devices in device owner mode are denied permissions without user interaction.

    Users can adjust app permissions in device settings before these permissions are denied automatically.

  On Android 12 or later, the following permissions can't be granted automatically but can be denied automatically. If you select Grant permissions automatically, the app will prompt the user for these permissions:

  • Location permissions
  • Permissions for camera
  • Permissions to record audio
  • Permission for activity recognition
  • Permissions to access body sensors data

Restrict storage features

On the Storage tab of the Feature restrictions section, you can enable or disable the following features:

• Prohibit debugging features

  Preventing use of debugging features.

  If the check box is selected, the device user cannot use USB debugging features and developer mode.

  If the check box is cleared, the device user is allowed to enable and access debugging features and developer mode.

  This check box is cleared by default.

• Prohibit mounting physical external media

  Selecting or clearing the check box specifies whether the device user is allowed to mount physical external media, such as SD cards and OTG adapters.

  This check box is cleared by default.

• Prohibit file transfer over USB

  Selecting or clearing this check box specifies whether the device user is allowed to transfer files over USB.

  This check box is cleared by default.

• Prohibit backup service (Android 8.0 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to enable or disable the backup service.

  The restriction is supported on devices with Android 8.0 or later.

  This check box is cleared by default.

Restrict network features

On the Network tab of the Feature restrictions section, you can enable or disable the following features:

• Prohibit use of Wi-Fi

  Selecting or clearing the check box specifies whether the device user is allowed to use Wi-Fi and configure it in Settings.

  This check box is cleared by default.

• Prohibit enabling/disabling Wi-Fi (Android 13 or later)

  If this option is enabled, the user cannot enable or disable Wi-Fi on the device. Also, Wi-Fi cannot be disabled via airplane mode.

  By default, the option is disabled.

• Prohibit changing Wi-Fi settings

  Selecting or clearing the check box specifies whether the device user is allowed to configure Wi-Fi access points via Settings. The restriction does not affect Wi-Fi tethering settings.

  This check box is cleared by default.

• Prohibit Wi-Fi Direct (Android 13 or later)

  If this option is enabled, the user cannot use the Wi-Fi Direct feature on the device.

  By default, the option is disabled.

• Prohibit sharing pre-configured Wi-Fi networks (Android 13 or later)

  If this option is enabled, the user cannot share Wi-Fi networks that are configured in the policy settings. Other Wi-Fi networks on the device are not affected.

  By default, the option is disabled.

• Prohibit adding Wi-Fi networks (Android 13 or later)

  If this option is enabled, the user cannot manually add new Wi-Fi networks on the device.

  By default, the option is disabled.

• Prohibit changing pre-configured Wi-Fi networks

  Selecting or clearing the check box specifies whether the device user is allowed to change Wi-Fi configurations added by the administrator in the Wi-Fi section.

  This check box is cleared by default.

• Prohibit airplane mode (Android 9 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to enable airplane mode on the device.

  This restriction is supported on devices with Android 9 or later.

  This check box is cleared by default.

• Prohibit use of Bluetooth (Android 8.0 or later)

  Preventing use of Bluetooth.

  If the check box is selected, the device user cannot turn on and configure Bluetooth via Settings.

  If the check box is cleared, the device user is allowed to use Bluetooth.

  The restriction is supported on devices with Android 8.0 and later. For earlier versions of Android, select the Prohibit use of Bluetooth check box in the Device Management section.

  This check box is cleared by default.

• Prohibit changing Bluetooth settings

  Selecting or clearing the check box specifies whether the device user is allowed to configure Bluetooth via Settings.

  This check box is cleared by default.

• Prohibit outgoing data sharing over Bluetooth (Android 8.0 or later)

  Selecting or clearing the check box specifies whether outgoing Bluetooth data sharing is allowed on the device.

  The restriction is supported on devices with Android 8.0 or later.

  This check box is cleared by default.

• Prohibit changing VPN settings

  Preventing changing VPN settings.

  If the check box is selected, the device user cannot configure a VPN in Settings and VPNs are prohibited from starting.

  If the check box is cleared, the device user is allowed to modify a VPN in Settings.

  This check box is cleared by default.

• Prohibit resetting network settings (Android 6 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to reset network settings in Settings.

  This restriction is supported on devices with Android 6 or later.

  This check box is cleared by default.

• Prohibit changing mobile network settings

  Selecting or clearing the check box specifies whether the device user is allowed to change mobile network settings.

  This check box is cleared by default.

• Prohibit use of cellular data while roaming (Android 7.0 or later)

  Selecting or clearing the check box specifies whether the device user is allowed to use cellular data while roaming.

  If the check box is selected, the device can't update anti-malware databases and synchronize with the Administration Server while in roaming.

  To allow anti-malware database update while roaming, this check box should be cleared and the Allow database update while roaming check box in the Database update section should be selected.

  To allow device synchronization with the Administration Server while roaming, this check box should be cleared and the Do not synchronize while roaming check box in the Synchronization section should be also cleared.

  This restriction is supported on devices with Android 7.0 or later.

  This check box is cleared by default.

• Prohibit use of Android Beam via NFC

  Selecting or clearing the check box specifies whether beaming out data from apps via NFC is allowed on the device. However, the device user can enable or disable NFC.

  This check box is cleared by default.

• Prohibit use of tethering

  Selecting or clearing the check box specifies whether the device user is allowed to configure tethering and hotspots.

  This check box is cleared by default.

Restrict location services

On the Location Services tab of the Feature restrictions section, you can configure the following settings:

• Prohibit use of location

  Preventing turning location on and off.

  If the check box is selected, the device user cannot turn location on or off. Search in Anti-Theft mode becomes unavailable.

  If the check box is cleared, the device user can turn location on or off.

  This check box is cleared by default.

  Various combinations of the Prohibit use of location and the Prohibit changing location settings (Android 9 or later) restriction values produce different results for location feature and configuration.

  Prohibit use of location	Prohibit changing location settings (Android 9 and later)	Feature restriction result
  Enabled	Enabled	Location is disabled and cannot be enabled by the device user.
  Enabled	Disabled	Location is disabled and can be enabled by the device user. Disabling the Prohibit changing location settings (Android 9) restriction makes it possible for the user to disable location on the device, which may make some features unavailable.
  Disabled	Enabled	Location is enabled and cannot be disabled by the device user.
  Disabled	Disabled	Location is enabled and can be disabled by the device user. Disabling the Prohibit changing location settings (Android 9) restriction makes it possible for the user to disable location on the device, which may make some features unavailable.

• Prohibit sharing location

  If this option is enabled, the user cannot share the device location via apps that provide such a feature (for example, Google Maps).

  By default, the option is disabled.

• Prohibit changing location settings (Android 9 or later)

  Preventing changing location settings.

  If the check box is selected, the device user cannot change location settings or disable location.

  If the check box is cleared, the device user can change location settings.

  The restriction is supported on devices with Android 9 or later.

  This check box is cleared by default.

  Various combinations of the Prohibit use of location and the Prohibit changing location settings (Android 9 or later) restriction values produce different results for location feature and configuration.

  Prohibit use of location	Prohibit changing location settings (Android 9 and later)	Feature restriction result
  Enabled	Enabled	Location is disabled and cannot be enabled by the device user.
  Enabled	Disabled	Location is disabled and can be enabled by the device user. Disabling the Prohibit changing location settings (Android 9) restriction makes it possible for the user to disable location on the device, which may make some features unavailable.
  Disabled	Enabled	Location is enabled and cannot be disabled by the device user.
  Disabled	Disabled	Location is enabled and can be disabled by the device user. Disabling the Prohibit changing location settings (Android 9) restriction makes it possible for the user to disable location on the device, which may make some features unavailable.

Restrict system updates

Managing update settings on mobile devices is vendor-specific. On some Android devices, the restriction on manual installation of operating system updates may work incorrectly.

On the Updates tab of the Feature restrictions section, you can configure the following settings:

• Set system update policy

  Type of system update policy.

  If the check box is selected, one of the following system update policies is set:

  • Install updates automatically. Installs system updates immediately without user interaction. This option is selected by default.
  • Install updates during daily window. Installs system updates during a daily maintenance window without user interaction.

    The administrator also needs to set the start and end of the daily maintenance window in the Start time and End time fields respectively.

  • Postpone updates for 30 days. Postpones the installation of system updates for 30 days.

    After the specified period, the operating system prompts the device user to install the updates. The period is reset and starts again if a new system update is available.

    If the check box is cleared, a system update policy is not set.

    This check box is selected by default.

    Managing update settings on mobile devices is vendor-specific. On some Android devices, the restriction on manual installation of operating system updates may work incorrectly.

• System update freeze periods (Android 9 and later)

  The System update freeze periods (Android 9 or later) block lets you set one or more freeze periods of up to 90 days during which system updates will not be installed on the device. When the device is in a freeze period, it behaves as follows:

  • The device does not receive any notifications about pending system updates.
  • System updates are not installed.
  • The device user cannot check for system updates manually.

    To add a freeze period, click Add period and enter the start and end of the freeze period in the Start time and End time fields respectively.

  Note: Each freeze period can be at most 90 days long, and the interval between adjacent freeze periods must be at least 60 days.

  The restriction is supported on devices with Android 9 or later.

  Managing update settings on mobile devices is vendor-specific. On some Android devices, the restriction on manual installation of operating system updates may work incorrectly.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring kiosk mode for Android devices

Expand all | Collapse all

Kiosk mode is a Kaspersky Endpoint Security for Android feature that lets you limit the set of apps available to a device user, whether a single app or multiple apps. You can also efficiently manage some device settings.

The kiosk mode settings apply to devices managed via Kaspersky Endpoint Security for Android in device owner mode.

Kiosk mode does not affect the work of the Kaspersky Endpoint Security for Android app. It runs in the background, shows notifications, and can be updated.

Kiosk mode types

The following kiosk mode types are available in Kaspersky Endpoint Security:

• Single-app mode

  Kiosk mode with only a single app. In this mode, a device user can open only one app that is allowed on the device and specified in the kiosk mode settings. If the app that you want to add to kiosk mode is not installed on the device, kiosk mode activates after the app is installed.

  On devices with Android 9 or later, the app launches directly in kiosk mode.

  On devices with Android 8.0 or earlier, the specified app must support kiosk mode functionality and call the startLockTask() method itself to launch the app.

• Multi-app mode

  Kiosk mode with multiple apps. In this mode, a device user can open only the set of apps that are allowed on the device and specified in the kiosk mode settings.

Presettings

Pre-configuration for kiosk mode includes the following:

• Before specifying apps that are allowed to be run on the device in kiosk mode, you need first to add these apps in App Control > List of categories and apps and mark them as required. Then, they will appear in the App package list of the kiosk mode.
• Before activating kiosk mode, we recommend that you prohibit launching of Google Assistant by enabling the corresponding restriction in Policy > Device owner mode > Feature restrictions > Apps > Prohibit use of Google Assistant. Otherwise, Google Assistant launches in kiosk mode and allows non-trusted apps to be opened.

Open the kiosk mode settings

To open the kiosk mode settings:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device owner mode → Kiosk mode section.

Configure single-app mode

To configure single-app mode:

1. In the Kiosk mode drop-down list, select Single-app mode.
2. In the App package drop-down list, select an app package with the app that is allowed to be run on the device.
3. Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
4. Select the Allow navigation to additional apps check box if you want to add other apps that a device user can navigate to. For more details, see the Add additional apps section below.
5. Click the Apply button to save the changes you have made.

Configure multi-app mode

To configure multi-app mode:

1. In the Kiosk mode drop-down list, select Multi-app mode.
2. Click Add, select apps that are allowed to be run on the device, and then click OK.
3. Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
4. Select the Allow navigation to additional apps check box if you want to add other apps that a device user can navigate to. For more details, see the Add additional apps section below.
5. Click the Apply button to save the changes you have made.

Kiosk mode restrictions

You can set the following restrictions in kiosk mode:

• Prohibit status bar (Android 9 or later)

  Selecting or clearing this check box specifies whether the status bar is blank with notifications and indicators such as connectivity, battery, and sound and vibrate options. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit Overview button (Android 9 or later)

  Selecting or clearing this check box specifies whether the Overview button is hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit Home button (Android 9 or later)

  Selecting or clearing this check box specifies whether the Home button is hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit displaying system notifications (Android 9 or later)

  Selecting or clearing this check box specifies whether system notifications are hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

Add additional apps

Besides locking the device to a single app or set of apps, you can also specify additional apps, that the main app can use. These additional apps provide full functionality of the apps added to kiosk mode. A device user cannot launch additional apps manually.

To add additional apps in the Kiosk mode section:

1. Select the Allow navigation to additional apps check box.
2. Click Add, specify the desired app package name, and then click OK. How to get the package name of an app

   To get the package name of an app:

   1. Open Google Play.
   2. Find the required app and open its page.

   The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

   To get the package name of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

3. Click the Apply button to save the changes you have made.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Connecting to an NDES/SCEP server

Expand all | Collapse all

You can configure a connection to an NDES/SCEP server to obtain a certificate from a certificate authority (CA) using Simple Certificate Enrollment Protocol (SCEP). To do this, you need to set up a connection to the CA using SCEP and specify a certificate profile.

To add a connection to a certificate authority and specify a certificate profile:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device owner mode > NDES and SCEP section.
5. In the Connection to certificate authority (CA) section, click Add.

   The Connection to certificate authority dialog appears.

6. Specify the following settings, and then click OK:
   • Connection name

     A unique connection name.

   • Protocol type

     A protocol version. Possible values:

     • SCEP
     • NDES (default)
   • SCEP server URL

     The URL of the SCEP server.

     For NDES, the URL has the http://<ServerName>/certsrv/mscep/mscep.dll format.

   • Challenge phrase type

     A type of challenge phrase required for authentication. Possible values:

     • None - Does not require authentication data.
     • Static - Requires entering an authentication phrase in the Static challenge phrase field. This is the default value.
   • Static challenge phrase

     Specifies the authentication phrase that is used to authenticate the device with the certificate with the SCEP server URL.

7. In the Certificate profiles section, click Add.

   The Certificate profile dialog appears.

8. Specify the following certificate profile settings and click OK:
   • Profile name

     A unique certificate profile name.

   • Certificate authority (CA)

     A certificate authority that you created in the Connection to certificate authority (CA) section.

   • Subject name

     A unique identifier that is the subject of the certificate. It includes information about what is being certified, including common name, organization, organizational unit, country code, and so on. You can either enter the value or select it from the Available macros drop-down list.

   • Private key length

     A length of the certificate private key. Possible values:

     • 1024
     • 2048 (default)
     • 4096
   • Private key type

     A type of the certificate private key. Possible values:

     • Signature (default)
     • Encryption
     • Signature and encryption
   • Renew certificate automatically

     If the check box is selected, the certificate will be automatically reissued to the device before this certificate expires. The Renew certificate before it expires (in days) field also becomes available. In this field, you need to specify the number of days before the expiration date when the certificate will be reissued.

     If the check box is cleared, the certificate will not be renewed automatically.

     The check box is cleared by default.

   • Renew certificate before it expires (in days)

     The number of days remaining until the certificate's expiration date during which a renewed certificate will be issued to the device. For example, you can specify 90 days in this field. A renewed certificate will be issued 90 days before the current certificate expires.

     This option is available and is required to be specified if the Renew certificate automatically check box is selected.

     The default value is not set.

   • Subject Alternative Names (SAN)

     An alternative name that represents the certificate subject name. You can specify multiple subject alternative names. To do this, click Add, and then specify the SAN type and SAN value options.

9. Click Apply to save the changes you have made.

Manage connections and certificate profiles

You can later edit or remove the added connections and certificate profile.

To edit a connection or certificate profile:

1. Select the needed connection or certificate profile in the corresponding section.
2. Click Edit, make the required changes, and click OK.
3. Click Apply to save the changes you have made.

After you edit the certificate profile in policy settings, the corresponding certificate on the device is deleted automatically during the next synchronization with Administration server and a new certificate is installed.

To remove a connection or certificate profile:

1. Select the needed connection or certificate profile in the corresponding section.
2. Click Delete, and then click OK.

   If you remove a certificate authority connection, all certificate profiles that use this connection are also removed.

3. Click Apply to save the changes you have made.

After you delete the certificate profile in policy settings, the corresponding certificate on the device will be deleted automatically during the next synchronization with Administration server.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Enabling certificate-based authentication of KES devices

To enable certificate-based authentication of a KES device:

1. Open the system registry of the client device that has Administration Server installed (for example, locally, using the regedit command in the Start → Run menu).
2. Go to the following hive:
   • For 32-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\Components\34\.core\.independent\KLLIM

   • For 64-bit systems:

     HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\KasperskyLab\Components\34\.core\.independent\KLLIM

3. Create a key with the LP_MobileMustUseTwoWayAuthOnPort13292 name.
4. Specify REG_DWORD as the key type.
5. Set the key value on 1.
6. Restart the Administration Server service.

Mandatory certificate-based authentication of the KES device using a shared certificate will be enabled after you run the Administration Server service.

The first connection of the KES device to the Administration Server does not require a certificate.

By default, certificate-based authentication of KES devices is disabled.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Creating a mobile applications package for KES devices

A Kaspersky Endpoint Security for Android license is required to create a mobile applications package for KES devices.

To create a mobile applications package:

1. In the Remote installation folder of the console tree, select the Installation packages subfolder.

   The Remote installation folder is a subfolder of the Advanced folder by default.

2. Click the Help button and select Mobile apps packages are intended for installation on mobile devices without Kaspersky Security Center. For example, a mobile apps package can be sent to a user by email or can be published on a Web Server for further download and installation in the drop-down list.
3. In the Mobile apps package management window, click the New button.
4. The New package wizard starts. Follow the instructions of the wizard.

The newly created mobile applications package is displayed in the Mobile apps package management window.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Viewing information about a KES device

To view information about a KES device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter KES devices by protocol type (KES).
3. Select the mobile device for which you want to view the information.
4. From the context menu of the mobile device select Properties.

The properties window of the KES device opens.

The properties window of the mobile device displays information about the connected KES device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Disconnecting a KES device from management

To disconnect a KES device from management, the user has to remove Network Agent from the mobile device. After the user has removed Network Agent, the mobile device details are removed from the Administration Server database, and the administrator can remove the mobile device from the list of managed devices.

To remove a KES device from the list of managed devices:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter KES devices by protocol type (KES).
3. Select the mobile device that you must disconnect from management.
4. In the context menu of the mobile device, select Delete.

The mobile device is removed from the list of managed devices.

If Kaspersky Endpoint Security for Android has not been removed from the mobile device, that mobile device reappears in the list of managed devices after synchronization with the Administration Server.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Managing iOS MDM devices

This section describes advanced features for management of iOS MDM devices through Kaspersky Security Center. The application supports the following features for management of iOS MDM devices:

• Define the settings of managed iOS MDM devices in centralized mode and restrict features of devices through configuration profiles. You can add or modify configuration profiles and install them on mobile devices.
• Install apps on mobile devices by means of provisioning profiles, bypassing App Store. For example, you can use provisioning profiles for installation of in-house corporate apps on users' mobile devices. A provisioning profile contains information about an app and a mobile device.
• Install apps on an iOS MDM device through the App Store. Before installing an app on an iOS MDM device, you must add that app to an iOS MDM Server.

Every 24 hours, a push notification is sent to all connected iOS MDM devices in order to synchronize data with the iOS MDM Server.

For information about the configuration profile and the provisioning profile, as well as apps installed on an iOS MDM device, please refer to the properties window of the device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Signing an iOS MDM profile by a certificate

You can sign an iOS MDM profile by a certificate. You can use a certificate that you issued yourself or you can receive a certificate from trusted certification authorities.

To sign an iOS MDM profile by a certificate:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.
2. In the context menu of the Mobile devices folder, select Properties.
3. In the properties window of the folder, select the Connection settings for iOS devices section.
4. Click the Browse button under the Select certificate file field.

   The Certificate window opens.

5. In the Certificate type field, specify the public or private certificate type:
   • If the PKCS #12 container value is selected, specify the certificate file and the password.
   • If the X.509 certificate value is selected:
     1. Specify the private key file (one with the *.prk or *.pem extension).
     2. Specify the private key password.
     3. Specify the public key file (one with the *.cer extension).
6. Click OK.

The iOS MDM profile is signed by a certificate.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Adding a configuration profile

To create a configuration profile, you can use Apple Configurator 2, which is available at the Apple Inc. website. Apple Configurator 2 works only on devices running macOS; if you do not have such devices at your disposal, you can use iPhone Configuration Utility on the device with Administration Console instead. However, Apple Inc. does not support iPhone Configuration Utility any longer.

To create a configuration profile using iPhone Configuration Utility and to add it to an iOS MDM Server:

1. In the console tree, select the Mobile Device Management folder.
2. In the workspace of the Mobile Device Management folder, select the Mobile Device Servers subfolder.
3. In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
4. In the context menu of the iOS MDM Server, select Properties.

   The Mobile Device Server properties window opens.

5. In the properties window of the iOS MDM Server, select the Configuration profiles section.
6. In the Configuration profiles section, click the Create button.

   The New configuration profile window opens.

7. In the New configuration profile window, specify a name and ID for the profile.

   The configuration profile ID should be unique; the value should be specified in Reverse-DNS format, for example, com.companyname.identifier.

8. Click OK.

   iPhone Configuration Utility then starts if you have it installed.

9. Reconfigure the profile in iPhone Configuration Utility.

   For a description of the profile settings and instructions on how to configure the profile, please refer to the documentation enclosed with iPhone Configuration Utility.

After you configure the profile with iPhone Configuration Utility, the new configuration profile is displayed in the Configuration profiles section in the properties window of the iOS MDM Server.

You can click the Modify button to modify the configuration profile.

You can click the Import button to load the configuration profile to a program.

You can click the Export button to save the configuration profile to a file.

The profile that you have created must be installed on iOS MDM devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Installing a configuration profile on a device

To install a configuration profile to a mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device on which you want to install a configuration profile.

   You can select multiple mobile devices to install the profile on them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Install profile section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands in the context menu of that mobile device, and then selecting Install profile.

   The Select profiles window opens showing a list of profiles. Select from the list the profile that you want to install on the mobile device. You can select multiple profiles to install them on the mobile device simultaneously. To select the range of profiles, use the Shift key. To combine profiles into a group, use the CTRL key.

6. Click OK to send the command to the mobile device.

   When the command is executed, the selected configuration profile will be installed on the user's mobile device. If the command is successfully executed, the current status of the command in the command log will be shown as Done.

   You can click the Resend button to send the command to the user's mobile device again.

   You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

7. Click OK to close the Mobile device <device name> management commands window.

You can view the profile that you installed and remove it, if necessary.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Removing the configuration profile from a device

To remove a configuration profile from a mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device from which you want to remove the configuration profile.

   You can select multiple mobile devices to remove the profile from them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Remove profile section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands from the context menu of the device, and then selecting Remove profile.

   The Remove profiles window opens showing a list of profiles.

6. Select from the list the profile that you want to remove from the mobile device. You can select multiple profiles to remove them from the mobile device simultaneously. To select the range of profiles, use the Shift key. To combine profiles into a group, use the CTRL key.
7. Click OK to send the command to the mobile device.

   When the command is executed, the selected configuration profile will be removed from the user's mobile device. If the command is executed successfully, the current status of the command will be shown as Completed.

   You can click the Resend button to send the command to the user's mobile device again.

   You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

8. Click OK to close the Mobile device <device name> management commands window.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Adding a provisioning profile

To add a

1. In the console tree, open the Mobile Device Management folder.
2. In the Mobile Device Management folder in the console tree, select the Mobile Device Servers subfolder.
3. In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
4. In the context menu of the iOS MDM Server, select Properties.

   The Mobile Device Server properties window opens.

5. In the properties window of the iOS MDM Server, go to the Provisioning profiles section.
6. In the Provisioning profiles section, click the Import button and specify the path to a provisioning profile file.

The profile will be added to the iOS MDM Server settings.

You can click the Export button to save the provisioning profile to a file.

You can install the provisioning profile that you imported on iOS MDM devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Installing a provisioning profile to a device

To install a provisioning profile on a mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device on which you want to install the provisioning profile.

   You can select multiple mobile devices to install the provisioning profile simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Install provisioning profile section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands from the context menu of that mobile device, and then selecting Install provisioning profile.

   The Select provisioning profiles window opens showing a list of provisioning profiles. Select from the list the provisioning profile that you want to install on the mobile device. You can select multiple provisioning profiles to install them on the mobile device simultaneously. To select the range of provisioning profiles, use the Shift key. To combine provisioning profiles into a group, use the Ctrl key.

6. Click OK to send the command to the mobile device.

   When the command is executed, the selected provisioning profile will be installed on the user's mobile device. If the command is successfully executed, its current status in the command log is shown as Completed.

   You can click the Resend button to send the command to the user's mobile device again.

   You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

7. Click OK to close the Mobile device <device name> management commands window.

You can view the profile that you installed and remove it, if necessary.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Removing a provisioning profile from a device

To remove a provisioning profile from a mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device from which you want to remove the provisioning profile.

   You can select multiple mobile devices to remove the provisioning profile from them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Remove provisioning profile section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands from the context menu and then selecting Remove provisioning profile.

   The Remove provisioning profiles window opens showing a list of profiles.

6. Select from the list the provisioning profile that you need to remove from the mobile device. You can select multiple provisioning profiles to remove them from the mobile device simultaneously. To select the range of provisioning profiles, use the Shift key. To combine provisioning profiles into a group, use the Ctrl key.
7. Click OK to send the command to the mobile device.

   When the command is executed, the selected provisioning profile will be removed from the user's mobile device. Applications that are related to the deleted provisioning profile will not be operable. If the command is executed successfully, the current status of the command will be shown as Completed.

   You can click the Resend button to send the command to the user's mobile device again.

   You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

8. Click OK to close the Mobile device <device name> management commands window.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring managed apps

Expand all | Collapse all

Before installing an app on an iOS MDM device, you must add that app to an iOS MDM Server. An app is considered managed if it has been installed on a device through Kaspersky Endpoint Security. A managed app can be managed remotely by means of Kaspersky Endpoint Security.

To add a managed app to an iOS MDM Server:

1. In the console tree, open the Mobile Device Management folder.
2. In the Mobile Device Management folder in the console tree, select the Mobile Device Servers subfolder.
3. In the workspace of the Mobile Device Servers folder, select an iOS MDM Server.
4. In the context menu of the iOS MDM Server, select Properties.

   This opens the properties window of the iOS MDM Server.

5. In the properties window of the iOS MDM Server, select the Managed applications section.
6. Click the Add button in the Managed applications section.

   The Add an application window opens.

7. In the Add an application window, in the App name field, specify the name of the app to be added.
8. In the Apple ID or link to manifest file field, specify the Apple ID of the application to be added, or specify a link to a manifest file that can be used to download the app.
9. If you want a managed app to be removed from the user's mobile device along with the iOS MDM profile when removing the latter, select the Remove together with iOS MDM profile check box.
10. If you want to block the app data backup through iTunes, select the Block data backup check box.
11. If you want to configure settings of the managed app, click the App configuration button.

    The App configuration window opens.

12. In the App configuration window, click the Browse button to select and upload a configuration file in PLIST format.

    To generate a configuration file, you may use a configuration generator (for example, https://appconfig.jamfresearch.com/generator) or refer to the official documentation on the app to be configured.

    An example of configured basic parameters for the Microsoft Outlook app.

    Microsoft Outlook app configuration settings

    Configuration key	Description	Type	Value	Default value
    com.microsoft.outlook.EmailProfile.EmailAccountName	Username	String	The username that will be used to pull the username from Microsoft Active Directory. It might be different from the user's email address. For example, User.
    com.microsoft.outlook.EmailProfile.EmailAddress	Email address	String	The email address that will be used to pull the user's email address from Microsoft Active Directory. For example, user@companyname.com.
    com.microsoft.outlook.EmailProfile.EmailUPN	User Principal Name or username for the email profile that is used to authenticate the account	String	The name of the user in email address format. For example, userupn@companyname.com.
    com.microsoft.outlook.EmailProfile.ServerAuthentication	Authentication method	String	Username and Password – Prompts the device user for their password. Certificates – Certificate-based authentication.	Username and Password
    com.microsoft.outlook.EmailProfile.ServerHostName	ActiveSync FQDN	String	The Exchange ActiveSync email server URL. You don't need to use HTTP:// or HTTPS:// in front of the URL. For example, mail.companyname.com.
    com.microsoft.outlook.EmailProfile.AccountDomain	Email domain	String	The account domain of the user. For example, companyname.
    com.microsoft.outlook.EmailProfile.AccountType	Authentication type	String	ModernAuth – Uses a token-based identity management method. Specify ModernAuth as the Account Type for Exchange Online. BasicAuth – Prompts the device user for their password. Specify BasicAuth as the Account Type for Exchange On-Premises.	BasicAuth
    IntuneMAMRequireAccounts	Is Sign-in required	String	Specifies whether organization account sign-in is required. You can select one of the following accepted values: Enabled - The app requires the user to sign-in to the managed user account defined by the IntuneMAMUPN key to receive Org data. Disabled - No account sign-in is required
    IntuneMAMUPN	UPN Adress	String	The User Principal Name of the account allowed to sign into the app. For example, userupn@companyname.com.

    An example of a configuration file for the Microsoft Outlook app.

    <?xml version="1.0" encoding="UTF-8"?>

    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    <plist version="1.0">

    <dict>

    <key>com.microsoft.outlook.EmailProfile.AccountType</key>

    <string>BasicAuth</string>

    <key>com.microsoft.outlook.EmailProfile.EmailAccountName</key>

    <string>My Work Email</string>

    <key>com.microsoft.outlook.EmailProfile.ServerHostName</key>

    <string>exchange.server.com</string>

    <key>com.microsoft.outlook.EmailProfile.EmailAddress</key>

    <string>%email%</string>

    <key>com.microsoft.outlook.EmailProfile.EmailUPN</key>

    <string>%full_name%</string>

    <key>com.microsoft.outlook.EmailProfile.AccountDomain</key>

    <string>my-domain</string>

    <key>com.microsoft.outlook.EmailProfile.ServerAuthentication</key>

    <string>Username and Password</string>

    <key>IntuneMAMAllowedAccountsOnly</key>

    <string>Enabled</string>

    <key>IntuneMAMUPN</key>

    <string>%full_name%</string>

    </dict>

    </plist>

13. After the PLIST file is imported, the app configuration will be displayed in the App configuration window.

    You can change the configuration by editing the text of the PLIST file after its import.

14. Click OK to apply the app configuration.
15. Click OK once again to close the Add an application window.

The added app is displayed in the Managed applications section of the properties window of the iOS MDM Server.

It is also possible to change or delete the configuration of an already added app.

To change the configuration of a managed app:

1. In the Managed applications section, select the managed app from the list, and then click the Modify button.

   The Changing mobile app settings window opens.

2. In the Changing mobile app settings window, click the App configuration button.

   The App configuration window opens.

3. Click the Browse button to select and upload a configuration file in PLIST format.
4. If necessary, edit the text of the PLIST file after its import.
5. Click OK to apply the app configuration.
6. Click OK to close the Changing mobile app settings window.

Mobile device settings are configured after the next device synchronization with the Kaspersky Security Center.

To delete a managed app configuration:

1. In the Managed applications section, select the managed app from the list, and then click the Modify button.

   The Changing mobile app settings window opens.

2. In the Changing mobile app settings window, click the Delete configuration button.

The applied configuration of the managed app is deleted.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Installing an app on a mobile device

To install an app on an iOS MDM mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device on which you want to install an app.

   You can select multiple mobile devices to install the application on them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Install app section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands in the context menu of that mobile device, and then selecting Install app.

   The Select apps window opens showing a list of profiles. Select from the list the application that you want to install on the mobile device. You can select multiple applications to install them on the mobile device simultaneously. To select a range of apps, use the Shift key. To combine apps into a group, use the Ctrl key.

6. Click OK to send the command to the mobile device.

   When the command is executed, the selected application will be installed on the user's mobile device. If the command is successfully executed, its current status in the command log will be shown as Completed.

   You can click the Resend button to send the command to the user's mobile device again. You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

7. Click OK to close the Mobile device <device name> management commands window.

Information about the application installed is displayed in the properties of the iOS MDM mobile device. You can remove the application from the mobile device through the command log or the context menu of the mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Removing an app from a device

To remove an app from a mobile device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device from which you want to remove the app.

   You can select multiple mobile devices to remove the app from them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Remove app section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands in the context menu of that mobile device, and then selecting Remove app.

   The Remove apps window opens showing a list of applications.

6. Select from the list the app that you need to remove from the mobile device. You can select multiple apps to remove them simultaneously. To select a range of apps, use the Shift key. To combine apps into a group, use the Ctrl key.
7. Click OK to send the command to the mobile device.

   When the command is executed, the selected app will be removed from the user's mobile device. If the command is executed successfully, the current status of the command will be shown as Completed.

   You can click the Resend button to send the command to the user's mobile device again.

   You can click the Remove from queue button to cancel execution of a command that was sent if the command has not yet been executed.

   The Command log section displays commands that have been sent to the mobile device, with the respective execution statuses. Click Refresh to update the list of commands.

8. Click OK to close the Mobile device <device name> management commands window.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Installing and uninstalling apps on a group of iOS MDM devices

Kaspersky Security Center allows you to install and remove apps on iOS MDM devices by sending commands to these devices.

Selecting devices

To select iOS MDM devices on which apps should be installed or removed:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices by protocol type (iOS MDM).
3. Select the iOS MDM device on which apps should be installed or removed.

   You can also select multiple devices and send commands simultaneously. To select a group of devices, do one of the following:

   • To select all devices in the workspace, filter the list of devices as required and press Ctrl+A.
   • To select a range of devices, hold down the Shift key, click the first device in the range, and then click the last device in the range.
   • To select individual devices, hold down the Ctrl key and click devices you want to include in the group.

Installing apps on devices

Before installing an app on an iOS MDM device, you must add that app to an iOS MDM Server. For more information, refer to Adding a managed app.

To install apps on selected iOS MDM devices:

1. Right-click the selected devices. In the context menu that appears, select All commands, and then select Install app.

   For a single device, you can also select Show command log in the context menu, proceed to the Install app section, and click the Send command button.

   The Select apps window opens showing a list of managed apps.

2. Select the apps you want to install on iOS MDM devices. To select a range of apps, use the Shift key. To select multiple apps individually, use the Ctrl key.
3. Click OK to send the command to the devices.

   When the command is executed on a device, the selected apps are installed. If the command is successfully executed, the command log will show its current status as Completed.

Removing apps from devices

To remove apps from selected iOS MDM devices:

1. Right-click the selected devices. In the context menu that appears, select All commands, and then select Remove app.

   For a single device, you can also select Show command log in the context menu, proceed to the Remove app section, and click the Send command button.

   The Remove apps window opens showing a list of previously installed apps.

2. Select the apps you want to remove from iOS MDM devices. To select a range of apps, use the Shift key. To select multiple apps individually, use the Ctrl key.
3. Click OK to send the command to the devices.

   When the command is executed on a device, the selected apps are uninstalled. If the command is successfully executed, the command log will show its current status as Completed.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring roaming on an iOS MDM mobile device

Expand all | Collapse all

To configure roaming:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device owned by the user for whom you want to configure roaming.

   You can select multiple mobile devices to configure roaming on them simultaneously.

4. In the context menu of the mobile device, select Show command log.
5. In the Mobile device <device name> management commands window, proceed to the Configure roaming section and click the Send command button.

   You can also send the command to the mobile device by selecting All commands → Configure roaming from the context menu of the device.

6. In the Roaming settings window, specify the relevant settings:
   • Enable data roaming

     If this option is enabled, the data roaming is enabled on the iOS MDM mobile device. The user of the iOS MDM mobile device can surf the internet while in roaming.

     By default, this option is disabled.

Roaming is configured for the selected devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Viewing information about an iOS MDM device

To view information about an iOS MDM device:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device for which you want to view the information.
4. From the context menu of the mobile device select Properties.

   The properties window of the iOS MDM device opens.

The properties window of the mobile device displays information about the connected iOS MDM device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Disconnecting an iOS MDM device from management

If you want to stop managing an iOS MDM device, you can disconnect it from management in Kaspersky Security Center.

As an alternative, you or the device owner can remove the iOS MDM profile from the device. However, after that you nevertheless must disconnect the device from management, as described in this section. Otherwise, you will not be able to start managing this device again.

To disconnect an iOS MDM device from the iOS MDM Server:

1. In the Mobile Device Management folder in the console tree, select the Mobile devices subfolder.

   The folder workspace displays a list of managed mobile devices.

2. In the workspace, filter iOS MDM devices:
   1. Click the No filter specified, records total: <number> link.
   2. On the Management protocol list, select iOS MDM.
3. Select the mobile device that you want to disconnect.
4. In the context menu of the mobile device, select Delete.

The iOS MDM device is marked in the list for removal. Within one minute, the device is removed from the iOS MDM Server database, after which it is automatically removed from the list of managed devices.

After the iOS MDM device is disconnected from management, all installed configuration profiles, the iOS MDM profile, and applications for which the Remove together with iOS MDM profile option has been enabled in the iOS MDM Server settings, will be removed from the mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring kiosk mode for iOS MDM devices

Expand all | Collapse all

Kiosk mode is an iOS feature that lets you limit the set of apps available to a device user to a single app. In this mode, a device user can open only one app that is allowed on the device and specified in the kiosk mode settings.

The kiosk mode settings apply to iOS MDM devices managed through Kaspersky Security Center.

Open the kiosk mode settings

To open the kiosk mode settings:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Kiosk mode section.

Configure kiosk mode

To enable kiosk mode:

1. Click the Enable kiosk mode (supervised only) check box to activate kiosk mode on a supervised device.
2. In the App's bundle ID field, enter the unique identifier of an app selected for kiosk mode (for example, com.apple.calculator). How to get the bundle ID of an app

   To get the bundle ID of a native iPhone or iPad app,

   Follow the instruction in Apple documentation.

   To get the bundle ID of any iPhone or iPad app:

   1. Open App Store.
   2. Find the required app and open its page.

      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

   3. Copy this identifier (without letters "id").
   4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

      This downloads a text file.

   5. Open the downloaded file and find there the "bundleId" fragment.

   The text that directly follows this fragment is the bundle ID of the required app.

   To get the bundle ID of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

   To select a different app, you need to disable kiosk mode, save the changes to the policy, and enable kiosk mode for a new app.

   The app that is selected for kiosk mode must be installed on the device. Otherwise, the device will be locked until kiosk mode is disabled.

   The use of the selected app must also be allowed in the policy settings. If the use of the app is prohibited, kiosk mode will not be enabled until the selected app is removed from the list of forbidden apps.

   In some cases, if the use of the selected app is prohibited in the policy settings, kiosk mode can still be enabled.

3. Specify the settings that will be enabled on the device in kiosk mode. For available settings, see the "Kiosk mode settings" section below.
4. Specify the settings that the user can edit on the device in kiosk mode.
5. Click the Apply button to save the changes you have made.

Once the changes to the policy are saved, kiosk mode is enabled. The selected app is forced to open on a supervised device, while the use of other apps is prohibited. The selected app reopens immediately after the device is restarted.

To edit the kiosk mode settings, you need to disable kiosk mode, save changes to the policy, and then enable kiosk mode again with the new settings.

To disable kiosk mode:

1. Select the Disable kiosk mode (supervised only) check box to deactivate kiosk mode on a supervised device.
2. Click the Apply button to save the changes you have made.

Once the changes to the policy are saved, kiosk mode is disabled. The use of all apps is allowed on a supervised device.

Now, you can enable kiosk mode again with the new settings.

Kiosk mode settings

• Auto-Lock

  If the check box is selected, Auto-Lock is enabled. The screen is automatically locked on the device.

  If the check box is cleared, Auto-Lock is disabled.

  This check box is selected by default.

• Touch (not recommended to disable)

  If the check box is selected, all touch input capabilities are enabled.

  If the check box is cleared, all touch input capabilities are disabled.

  This check box is selected by default.

• AssistiveTouch

  If the check box is selected, AssistiveTouch is enabled. The device screen is adapted to the user's unique physical needs.

  If the check box is cleared, AssistiveTouch is disabled.

  This check box is cleared by default.

• Voice Control

  If the check box is selected, Voice Control is enabled. The user can navigate and interact with the device using voice commands.

  If the check box is cleared, Voice Control is disabled.

  This check box is cleared by default.

• VoiceOver

  If the check box is selected, VoiceOver is enabled. Audible descriptions of what appears on the screen are given.

  If the check box is cleared, VoiceOver is disabled.

  This check box is cleared by default.

• Speak Selection

  If the check box is selected, Speak Selection is enabled. The text selected on the screen is spoken.

  If the check box is cleared, Speak Selection is disabled.

  This check box is cleared by default.

• Volume Buttons

  If the check box is selected, the volume buttons are enabled. The user can adjust the volume on the device.

  If the check box is cleared, the volume buttons are disabled.

  This check box is selected by default.

• Mono Audio

  If the check box is selected, Mono Audio is enabled. The left and right headphone channels are combined to play the same content.

  If the check box is cleared, Mono Audio is disabled.

  This check box is cleared by default.

• Zoom

  If the check box is selected, Zoom is enabled. The user can zoom in and out the content on the screen.

  If the check box is cleared, Zoom is disabled.

  This check box is selected by default.

• Auto-Rotate Screen

  If the check box is selected, Auto-Rotate Screen is enabled. Screen orientation automatically changes when the device is rotated.

  If the check box is cleared, Auto-Rotate Screen is disabled.

  This check box is selected by default.

• Invert Colors

  If the check box is selected, inverting colors on the screen is enabled. The displayed colors are changed to opposite colors.

  If the check box is cleared, inverting colors on the screen is disabled.

  This check box is cleared by default.

• Ring/Silent Switch

  If the check box is selected, Ring/Silent Switch is enabled. The user can switch between Ring and Silent modes to mute or unmute sounds and alerts.

  If the check box is cleared, Ring/Silent Switch is disabled.

  This check box is selected by default.

• Sleep/Wake Button

  If the check box is selected, the Sleep/Wake button is enabled. The user can put the device to sleep or wake the device.

  If the check box is cleared, the Sleep/Wake button is disabled.

  This check box is selected by default.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Management of mobile device settings

This section contains information about how to remotely manage the settings of mobile devices in the Administration Console of Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring connection to a Wi-Fi network

This section provides instructions on how to configure automatic connection to a corporate Wi-Fi network on Android and iOS MDM devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Connecting Android devices to a Wi-Fi network

Expand all | Collapse all

For an Android device to automatically connect to an available Wi-Fi network and protect data during the connection, you should configure the connection settings.

To connect the mobile device to a Wi-Fi network:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Wi-Fi section.
5. In the Wi-Fi networks section, click Add.

   This opens the Wi-Fi network window.

6. In the Service set identifier (SSID) field, enter the name of the Wi-Fi network that includes the access point (SSID).
7. Select the Hidden network check box if you want the Wi-Fi network to be hidden in the list of available networks on the device. In this case, to connect to the network the user needs to manually enter the Service set identifier (SSID) specified in the settings of the Wi-Fi router on the mobile device.
8. Select the Automatic connection to network check box if you want the device to connect to the Wi-Fi network automatically.
9. In the Network protection section, select the type of Wi-Fi network security (open or secure network protected with the WEP, WPA/WPA2 PSK, or 802.1.x EAP protocol).

   The 802.1.x EAP security protocol is supported only in the Kaspersky Endpoint Security for Android app version 10.48.1.1 or later. The WEP protocol is supported only on Android 9 or earlier.

10. If you selected the 802.1.x EAP security protocol, specify the following network protection settings:
    • EAP method

      Specifies an Extensible Authentication Protocol (EAP) method of network authentication. Possible values:

      • TLS (default)
      • PEAP
      • TTLS
    • Root certificate

      Specifies the root certificate to be used by the Wi-Fi network if the TLS EAP method is selected.

      You can specify a certificate in one of the following ways:

      • Select any available certificate from the drop-down list. It contains certificates previously added to the Root certificates section. On devices, these certificates are installed to a trusted certificate store.
      • Load a new certificate file (.cer, .pem, or .key) by clicking Browse. This certificate will not be added to the Root certificates section. On devices, the certificate will be used only for configuring this Wi-Fi network and will not be installed to a trusted certificate store.
    • Domain

      Specifies the constraint for the server domain name.

      If set, this Fully Qualified Domain Name (FQDN) is used as a suffix match requirement for the root certificate in SubjectAltName dNSName element(s). If a matching dNSName is found, this constraint is met.

      You can specify multiple match strings using semicolons to separate the strings. A match with any of the values is considered a sufficient match for the certificate (i.e., the OR operator is used).

      If you specify *, any root certificate is considered valid. This value is specified by default.

    • User certificate

      Specifies the user certificate to be used by the Wi-Fi network if the TLS EAP method is selected.

      The following values are available in the drop-down list:

      • None - The user certificate is not specified.
      • VPN certificate - The VPN certificate that was last added in the Mobile Device Management > Certificates section of the Kaspersky Security Center Administration Console and was installed on the user device. If you choose this option, but no VPN certificate is installed on the device, the user certificate is not used for this Wi-Fi network.
      • List of SCEP certificate profiles configured in the SCEP and NDES section and used to obtain certificates.
    • Type of two-factor authentication

      Specifies a two-factor authentication type. Possible values:

      • None (default)
      • MSCHAP
      • MSCHAPV2
      • GTC
    • User identity

      Specifies a user ID to be used if the TLS EAP method is selected. You can either enter the value or select it from the Available macros drop-down list.

    • Anonymous identity

      Specifies an anonymous identity that is different from User identity and is used if the PEAP method of network authentication is selected. You can either enter the value or select it from the Available macros drop-down list.

    • Available macros

      A macro that will be used to replace values in the corresponding fields. Possible values:

      • %email%. Specifies the email address of the user to whom the device is registered. The value is retrieved from a mobile certificate.
      • %email_domain%. Specifies the email address domain of the user to whom the device is registered. The value is retrieved from a mobile certificate.
      • %email_user_name%. Specifies the username from the email address to which the device is registered. The value is retrieved from a mobile certificate.
      • %user_name%. Specifies the username under which the device is registered. The value is retrieved from a mobile certificate.
      • %device_id%. Specifies the ID of the device.
      • %group_id%. Specifies the ID of the administration group to which the device belongs to.
      • %device_platform%. Specifies the device platform.
      • %device_model%. Specifies the device model.
      • %os_version%. Specifies the operating system version on the device.
    • Password

      Specifies a password for accessing a wireless network protected using a WEP or WPA2 PSK protocol. The password will be sent in QR code.

      Do not use a password for a confidential Wi-Fi network. The password is sent to the user in the open way along with other necessary configuration data.

11. In the Password field, set a network access password if you selected a secure network at step 9.
12. Select the Use proxy server option if you want to use a proxy server to connect to a Wi-Fi network. Otherwise, select the Do not use proxy server option.
13. If you selected Use proxy server, in the Proxy server address and port field, enter the IP address or DNS name of the proxy server and port number, if necessary.

    On devices running Android version 8.0 or later, settings of the proxy server for Wi-Fi cannot be redefined with the policy. However, you can manually configure the proxy server settings for a Wi-Fi network on the mobile device.

    If you are using a proxy server to connect to a Wi-Fi network, you can use a policy to configure the settings for connecting to the network. On devices running Android 8.0 or later, you must manually configure the proxy server settings. On devices running Android 8.0 or later, you cannot use a policy to change the Wi-Fi network connection settings, except for the network access password.

    If you are not using a proxy server to connect to a Wi-Fi network, there are no limitations on using policies to manage a Wi-Fi network connection.

14. In the Do not use proxy server for addresses field, generate a list of web addresses that can be accessed without the use of the proxy server.

    For example, you can enter the address example.com. In this case, the proxy server will not be used for the addresses pictures.example.com, example.com/movies, etc. The protocol (for example, http://) can be omitted.

    On devices running Android version 8.0 or later, the proxy server exclusion for web addresses does not work.

15. Click OK.

    The added Wi-Fi network is displayed in the list of Wi-Fi networks.

    This list contains the names of suggested wireless networks.

    On personal devices running Android 10 or later, the operating system prompts the user to connect to such networks. Suggested networks don't appear on the saved networks list on these devices.

    On devices operating in device owner mode and personal devices running Android 9 or earlier, after synchronizing the device with the Administration Server, the device user can select a suggested wireless network in the saved networks list and connect to it without having to specify any network settings.

    You can modify or delete Wi-Fi networks in the list of networks using the Edit and Delete buttons at the top of the list.

16. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

On devices running Android version 10 or later, if a user refuses to connect to the suggested Wi-Fi network, the app's permission to change Wi-Fi state is revoked. The user must grant this permission manually.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Connecting iOS MDM devices to a Wi-Fi network

For an iOS MDM device to automatically connect to an available Wi-Fi network and protect data during the connection, you should configure the connection settings.

To configure the connection of an iOS MDM device to a Wi-Fi network:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Wi-Fi section.
5. Click the Add button in the Wi-Fi networks section.

   This opens the Wi-Fi network window.

6. In the Service set identifier (SSID) field, enter the name of the Wi-Fi network that includes the access point (SSID).
7. If you want the iOS MDM device to connect to the Wi-Fi network automatically, select the Automatic connection check box.
8. To make it impossible to connect iOS MDM devices to a Wi-Fi network requiring preliminary authentication (captive network), select the Disable captive networks detection check box.

   To use a captive network, you must subscribe, accept an agreement, or make a payment. Captive networks may be deployed in cafes and hotels, for example.

9. If you want the Wi-Fi network to be hidden in the list of available networks on the iOS MDM device, select the Hidden Network check box.

   In this case, to connect to the network the user needs to manually enter the Service set identifier (SSID) specified in the settings of the Wi-Fi router on the mobile device.

10. In the Network protection drop-down list, select the type of protection of the Wi-Fi network connection:
    • Disabled. User authentication is not required.
    • WEP. The network is protected using Wireless Encryption Protocol (WEP).
    • WPA/WPA2 (Personal). The network is protected using WPA / WPA2 protocol (Wi-Fi Protected Access).
    • WPA2 (Personal). The network is protected using WPA2 protocol (Wi-Fi Protected Access 2.0). WPA2 protection is available on devices running iOS version 8 or later. WPA2 is not available on Apple TV devices.
    • Any (Personal). The network is protected using the WEP, WPA or WPA2 encryption protocol depending on the type of Wi-Fi router. An encryption key unique to each user is used for authentication.
    • WEP (Dynamic). The network is protected using the WEP protocol with the use of a dynamic key.
    • WPA/WPA2 (Enterprise). The network is protected using the WPA/WPA2 encryption protocol with use of the 802.1X protocol.
    • WPA2 (Enterprise). The network is protected using the WPA2 encryption protocol with the use of one key shared by all users (802.1X). WPA2 protection is available on devices running iOS version 8 or later. WPA2 is not available on Apple TV devices.
    • Any (Enterprise). The network is protected using WEP or WPA / WPA2 protocol depending on the type of Wi-Fi router. One encryption key shared by all users is used for authentication.

    If you have selected WEP (Dynamic), WPA/WPA2 (Enterprise), WPA2 (Enterprise) or Any (Enterprise) in the Network protection list, in the Protocols section you can select the types of EAP protocols (Extensible Authentication Protocol) for user identification on the Wi-Fi network.

    In the Trusted certificates section, you can also create a list of trusted certificates for authentication of the iOS MDM device user on trusted servers.

11. Configure the settings of the account for user authentication upon connection of the iOS MDM device to the Wi-Fi network:
    1. In the Authentication section, click the Configure button.

       The Authentication window opens.

    2. In the User name field, enter the account name for user authentication upon connection to the Wi-Fi network.
    3. To require the user to enter the password manually upon every connection to the Wi-Fi network, select the Prompt for password at each connection check box.
    4. In the Password field, enter the password of the account for authentication on the Wi-Fi network.
    5. In the Authentication certificate drop-down list, select a certificate for user authentication on the Wi-Fi network. If the list does not contain any certificates, you can add them in the Certificates section.
    6. In the User ID field, enter the user ID displayed during data transmission upon authentication instead of the user's real name.

       The user ID is designed to make the authentication process more secure, as the user name is not displayed openly, but transmitted via an encrypted TLS tunnel.

    7. Click OK.

    As a result, the settings of the account for user authentication upon connection to the Wi-Fi network will be configured on the iOS MDM device.

12. If necessary, configure the settings of the Wi-Fi network connection via a proxy server:
    1. In the Proxy server section, click the Configure button.
    2. In the Proxy server window that opens, select the proxy server configuration mode and specify the connection settings.
    3. Click OK.

    As a result, the settings of the device connection to the Wi-Fi network via a proxy server are configured on the iOS MDM device.

13. Click OK.

    The new Wi-Fi network is displayed in the list.

14. Click the Apply button to save the changes you have made.

As a result, a Wi-Fi network connection will be configured on the user's iOS MDM device once the policy is applied. The user's mobile device will automatically connect to available Wi-Fi networks. Data security during a Wi-Fi network connection is ensured by the authentication technology.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring email

This section contains information on configuring mailboxes on mobile devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring a mailbox on iOS MDM devices

To enable an iOS MDM device user to work with email, add the user's email account to the list of accounts on the iOS MDM device.

By default, the email account is added with the following settings:

• Email protocol – IMAP.
• The user can move email messages between the user's accounts and synchronize account addresses.
• The user can use any email clients (other than Mail) to use email.
• The SSL connection is not used during transmission of messages.

You can edit the specified settings when adding the account.

To add an email account of the iOS MDM device user:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Email.
5. Click the Add button in the Email account section.

   The Email account window opens.

6. In the Description field, enter a description of the user's email account.
7. Select the email protocol:
   • POP
   • IMAP
8. If necessary, specify the IMAP path prefix in the IMAP path prefix field.

   The IMAP path prefix must be entered using upper-case letters (for example: GMAIL for Google Mail). This field is available if the IMAP account protocol is selected.

9. In the User name as displayed in messages field, enter the user name to be displayed in the From: field for all outgoing messages.
10. In the Email address field, specify the email address of the iOS MDM device user.
11. Configure Additional Settings of the email account:
    • To allow the user to move email messages between the user's accounts, select the Allow movement of messages between accounts check box.

      If you want to prohibit saving, moving, and sharing attachments from a corporate mailbox, clear the Allow movement of messages between accounts, Allow non-managed apps to use documents from managed apps, and Allow managed apps to use documents from non-managed apps check boxes.

    • To allow the email addresses used to be synchronized among user accounts, select the Allow sync of recent addresses check box.
    • To allow a user to use the Mail Drop service to forward large-sized attachments, select the Allow Mail Drop check box.
    • To allow the user to use only the standard iOS mail client, select the Allow use of only Mail app check box.
12. Configure the settings for using the S/MIME protocol in the Mail app. S/MIME is a protocol for transmitting digitally signed encrypted messages.
    • To use the S/MIME protocol to sign outgoing mail, select the Sign messages check box and select a certificate for the signature. A digital signature confirms the authenticity of the sender and indicates that the contents of the message have not been modified during transmission to the recipient. A message signature is available on devices running iOS version 10.3 or later.
    • To use the S/MIME protocol to encrypt outgoing mail, select the Encrypt messages by default check box and select a certificate for encryption (public key). Message encryption is available on devices running iOS version 10.3 or later.
    • To enable a user to encrypt individual messages, select the Show toggle button for encrypting messages check box. To send encrypted messages, the user must click the icon in the Mail app in the To field.
13. In the Inbound mail server and Outbound mail server sections, click the Settings button to configure the server connection settings:
    • Server address and port: Names of hosts or IP addresses of inbound mail servers and outbound mail servers and server port numbers.
    • Account name: Name of the user's account for inbound and outbound mail server authorization.
    • Authentication type: Type of user's email account authentication on inbound mail servers and outbound mail servers.
    • Password: Account password for authentication on the inbound and outbound mail server protected using the selected authentication method.
    • Use one password for incoming and outgoing mail servers: use one password for user authentication on incoming and outgoing mail servers.
    • Use SSL connection: usage of the SSL (Secure Sockets Layer) data transport protocol that uses encryption and certificate-based authentication to secure data transmission.
14. Click OK.

    The new email account appears in the list.

15. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, email accounts from the compiled list will be added on the user's mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring an Exchange mailbox on iOS MDM devices

To enable the iOS MDM device user to use corporate email, calendar, contacts, notes, and tasks, add the user's Exchange ActiveSync account on the Microsoft Exchange server.

By default, an account with the following settings is added on the Microsoft Exchange server:

• Email is synchronized once per week.
• The user can move messages between the user's accounts and synchronize account addresses.
• The user can use any email clients (other than Mail) to use email.
• The SSL connection is not used during transmission of messages.

You can edit the specified settings when adding the Exchange ActiveSync account.

To add the Exchange ActiveSync account of the iOS MDM device user:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Exchange ActiveSync section.
5. Click the Add button in the Exchange ActiveSync accounts section.

   The Exchange ActiveSync account window opens on the General tab.

6. In the Account name field, enter the account name for authorization on the Microsoft Exchange server. You can use macros from the Macros available drop-down list.
7. In the Server address field, enter the network name or IP address of the Microsoft Exchange server.
8. To use the SSL (Secure Sockets Layer) data transport protocol to secure the transmission of data, select the Use SSL connection check box.
9. In the Domain field, enter the name of the iOS MDM device user's domain. You can use macros from the Macros available drop-down list.
10. In the Account User Name field, enter the name of the iOS MDM device user.

    If you leave this field blank, Kaspersky Device Management for iOS prompts the user to enter the user name when applying the policy on the iOS MDM device. You can use macros from the Macros available drop-down list.

11. In the Email address field, specify the email address of the iOS MDM device user. You can use macros from the Macros available drop-down list.
12. In the Password field, enter the password of the Exchange ActiveSync account for authorization on the Microsoft Exchange server.
13. Select the Additional tab and configure the additional settings of the Exchange ActiveSync account:
    • Number of Days to Sync Mail for <time period>.
    • Authentication type.
    • Allow movement of messages between accounts.

      If you want to prohibit saving, moving, and sharing attachments from a corporate mailbox, clear the Allow movement of messages between accounts, Allow non-managed apps to use documents from managed apps, and Allow managed apps to use documents from non-managed apps check boxes.

    • Allow sync of recent addresses.
    • Allow use of only Mail app.
14. Configure the settings for using the S/MIME protocol in the Mail app. S/MIME is a protocol for transmitting digitally signed encrypted messages.
    • To use the S/MIME protocol to sign outgoing mail, select the Sign messages check box and select a certificate for the signature. A digital signature confirms the authenticity of the sender and indicates that the contents of the message have not been modified during transmission to the recipient. A message signature is available on devices running iOS version 10.3 or later.
    • To use the S/MIME protocol to encrypt outgoing mail, select the Encrypt messages by default check box and select a certificate for encryption (public key). Message encryption is available on devices running iOS version 10.3 or later.
    • To enable a user to encrypt individual messages, select the Show toggle button for encrypting messages check box. To send encrypted messages, the user must click the icon in the Mail app in the To field.
15. Click OK.

    The new Exchange ActiveSync account appears in the list.

16. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, Exchange ActiveSync accounts from the compiled list will be added on the user's mobile device.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring an Exchange mailbox on Android devices (only Samsung)

To work with corporate mail, contacts, and the calendar on the mobile device, you should configure the Exchange mailbox settings (available only on Android 9 and earlier).

Configuration of an Exchange mailbox is possible only for Samsung devices.

To configure an Exchange mailbox on a mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Manage Samsung KNOX → Manage Samsung devices section.
5. In the Exchange ActiveSync window, click the Configure button.

   The Exchange mail server settings window opens.

6. In the Server address field, enter the IP address or DNS name of the server hosting the mail server.
7. In the Domain field, enter the name of the mobile device user's domain on the corporate network.
8. In the Synchronization interval drop-down list, select the desired interval for mobile device synchronization with the Microsoft Exchange server.
9. To use the SSL (Secure Sockets Layer) data transport protocol, select the Use SSL connection check box.
10. To use digital certificates to protect data transfer between the mobile device and the Microsoft Exchange server, select the Verify server certificate check box.
11. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Configuring device status in Kaspersky Security Center

To configure the device status in Kaspersky Security Center:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy properties window, select the Device information section.
5. In the window that opens, select the OK, Critical, or Warning status for each of the following conditions:
   • Real-time protection is not running
   • Web Protection is not running
   • App Control is not running
   • Device lock is not available
   • Device locate is not available
   • The versions of the KSN Statement do not match
   • The versions of the Marketing Statement do not match
6. Click the OK button.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Managing app configurations

This section provides instructions on how to manage settings and edit configurations of the apps installed on your users' devices.

The help for this version of the solution is no longer updated, so it may contain outdated information. For up-to-date information about the solution refer to the Kaspersky Secure Mobility Management 4.1 Help.

Managing Google Chrome settings

Expand all | Collapse all

The Google Chrome settings section lets you manage settings of Google Chrome installed in Android work profile or on devices managed via the Kaspersky Endpoint Security for Android app in device owner mode.

To open the Google Chrome settings section:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App configuration > Google Chrome settings section.

Manage content settings

On the Content tab of the Google Chrome settings section, you can specify the following content settings:

• Set default cookie settings

  Default cookie settings.

  If the check box is selected, one of the following options will be applied to all sites by default:

  • Allow all sites to set local data (default)
  • Do not allow any site to set local data

  • If the check box is cleared, the user's personal settings will be applied.

    The setting is supported in Google Chrome version 30 or later.

    This check box is selected by default.

    There must be no conflicting URL patterns that you specify in the Allow cookies on these sites, Block cookies on these sites, and Allow cookies on these sites for one session only fields. If no URL is specified and the Set default cookies settings check box is selected, the option selected in the drop-down list will be applied to all sites.

• Allow cookies on these sites

  A list of sites that are allowed to set cookies. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 30 or later.

• Block cookies on these sites

  A list of sites that are prohibited to set cookies. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 30 or later.

• Allow cookies on these sites for one session only

  A list of sites that are allowed to set cookies only for one session. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 30 or later.

• Set default JavaScript settings

  Default JavaScript settings.

  If the check box is selected, one of the following options will be applied and the device user will not be able to change it:

  • Allow all sites to run JavaScript (default)
  • Do not allow any site to run JavaScript

    If the check box is cleared, user personal settings will be applied.

    The setting is supported in Google Chrome version 30 or later.

    This check box is cleared by default.

    If the Allow JavaScript on these sites and Block JavaScript on these sites settings are not specified and the Set default JavaScript settings check box is selected, the selected option will be applied to all sites.

• Allow JavaScript on these sites

  A list of sites that are allowed to run JavaScript. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 30 or later.

  If the Allow JavaScript on these sites and Block JavaScript on these sites settings are not specified and the Set default JavaScript settings check box is selected, the selected option will be applied to all sites.

• Block JavaScript on these sites

  A list of sites that are prohibited to run JavaScript. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 30 or later.

  If the Allow JavaScript on these sites and Block JavaScript on these sites settings are not specified and the Set default JavaScript settings check box is selected, the selected option will be applied to all sites.

• Set default pop-up settings (based on Google abusive pop-ups database)

  Default pop-up setting.

  If the check box is selected, one of the following options applies to pop-ups:

  • Allow all sites to show pop-ups. Lets all sites open pop-up windows. This value is selected by default.
  • Do not allow any site to show pop-ups. Prohibits all sites to open pop-up windows.

    Only those pop-ups will be blocked that are included into the Google abusive pop-ups database.

    If the check box is cleared, pop-ups are blocked, but a device user can change this behavior in Settings.

    The setting is supported in Google Chrome version 33 or later.

    The check box is cleared by default.

    If the Allow pop-ups on these sites and Block pop-ups on these sites (based on Google abusive pop-ups database) settings are not specified and the Set default pop-up settings check box is selected, the selected option will be applied to all sites.

• Allow pop-ups on these sites

  A list of sites that are allowed to show pop-ups. You can also set URL patterns, for example: [*.]example.com.

  The setting is supported in Google Chrome version 34 or later.

  If the Allow pop-ups on these sites and Block pop-ups on these sites settings are not specified and the Set default pop-up settings check box is selected, the selected option will be applied to all sites.

• Block pop-ups on these sites (based on Google abusive pop-ups database)

  A list of sites that are prohibited to show pop-ups. You can also set URL patterns, for example: [*.]example.com.

  Only those pop-ups will be blocked that are included into the Google abusive pop-ups database.

  The setting is supported in Google Chrome version 34 or later.

  If the Allow pop-ups on these sites and Block pop-ups on these sites settings are not specified and the Set default pop-up settings check box is selected, the selected option will be applied to all sites.

• Set user location tracking settings

  The default geographic location settings.

  If the check box is selected, one of the following options will be applied to all sites by default:

  • Allow all sites to track location
  • Do not allow any site to track location
  • Ask whenever site wants to track location (default)

    If the check box is cleared, user personal settings will be applied.

    The setting is supported in Google Chrome version 30 or later.

    This check box is cleared by default.

Manage proxy settings

On the Proxy tab of the Google Chrome settings section, you can specify the following proxy settings:

• Set proxy mode

  Proxy settings for Google Chrome and ARC-apps.

  If the check box is selected, one of the following options will be applied and the device user is prevented from changing proxy settings:

  • Never use proxy. Prohibits use of proxies and all other proxy settings are ignored. This option is selected by default.
  • Detect proxy settings automatically. Detects proxy settings automatically and all other options are ignored.
  • Use PAC file. Uses the proxy PAC file specified in the PAC file URL field.
  • Use fixed proxy servers. Uses the data specified in the Proxy server URL and Bypass list fields.
  • Use system proxy settings. Uses the system proxy settings.

    If the check box is cleared, user personal settings will be applied.

    The setting is supported in Google Chrome version 30 or later.

    This check box is selected by default.

• Proxy server URL

  A URL of the proxy server.

  The setting is supported in Google Chrome version 30 or later.

• PAC file URL

  A URL to a proxy .PAC file.

  The setting is supported in Google Chrome version 30 or later.

• Bypass list

  A list of hosts for which the proxy will be bypassed.

  The setting is supported in Google Chrome version 30 or later.

Manage search settings

On the Search tab of the Google Chrome settings section, you can specify the following search settings:

• Enable Touch to Search

  Selecting or clearing this check box specifies whether the device user is allowed to use Touch to Search and turn the feature on or off.

  The setting is supported in Google Chrome version 40 or later.

  This check box is selected by default.

• Enable default search provider

  Default search provider settings.

  If the check box is selected, a default search provider is used when a user enters non-URL text in the address bar. The default search provider depends on search provider settings below this check box:

  • If you leave search provider settings empty, the device user can choose the search provider in the browser settings.
  • If you configure settings of the default search provider, this search provider is always used, and the device user can't choose the search provider in the browser.

  This check box is selected by default, but the default search provider settings are not configured.

  If you want to disable search in Google Chrome, we recommend that you leave the Enable default search provider check box selected and set the Search provider name parameter to the site of a non-search system. On some Google Chrome versions, there can be problems in Google Chrome operation if the check box is cleared.

  The setting is supported in Google Chrome version 30 or later.

  The default search provider parameters are:

  • Search provider name
  • Keyword
  • Search URL
  • Suggest URL
  • Icon URL
  • Encodings
  • Alternate URLs
  • Image URL
  • New tab URL
  • Parameters for search URL that uses POST
  • Parameters for suggest URL that uses POST
  • Parameters for image URL that uses POST
• Search provider name

  The default search provider name.

  The setting is supported in Google Chrome version 30 or later.

• Search URL

  The URL of the search engine used during default searches.

  The setting is supported in Google Chrome version 30 or later.

• Icon URL

  The URL of the default search provider's favicon.

  The setting is supported in Google Chrome version 30 or later.

• Encodings

  Character encodings supported by the search provider. The supported encodings are:

  • UTF-8
  • UTF-16
  • GB2312
  • ISO-8859-1

    The setting is supported in Google Chrome version 30 or later.

• Alternate URLs

  A list of alternate URLs to retrieve search terms from the search engine.

  The setting is supported in Google Chrome version 30 or later.

• New tab URL

  The URL of the search engine used to provide a New Tab page.

  The setting is supported in Google Chrome version 30 or later.

• Parameters for search URL that uses POST

  URL parameters when searching a URL with the POST method. The parameters are comma-separated key-value pairs. If a value is a template parameter, for example, '{searchTerms}', it is replaced with real search terms. For example:

  q={searchTerms},ie=utf-8,oe=utf-8

  The setting is supported in Google Chrome version 30 or later.

• Parameters for suggest URL that uses POST

  URL parameters for search suggestions using the POST method. The parameters are comma-separated key-value pairs. If a value is a template parameter, for example, '{searchTerms}', it is replaced with real search terms. For example:

  q={searchTerms},ie=utf-8,oe=utf-8

  The setting is supported in Google Chrome version 30 or later.

• Parameters for image URL that uses POST

  URL parameters for image search using the POST method. The parameters are comma-separated key-value pairs. If a value is a template parameter, for example, '{imageThumbnail}', it is replaced with the real image thumbnail. For example:

  content={imageThumbnail},url={imageURL},sbisrc={SearchSource}

  The setting is supported in Google Chrome version 30 or later.