Control

This section contains information about how to remotely monitor mobile devices in the Administration Console of Kaspersky Security Center.

Configuring restrictions

This section provides instructions on how to configure user access to the features of mobile devices.

Special considerations for devices running Android 10 or later

Android 10 introduced numerous changes and restrictions targeting API 29 or higher. Some of these changes affect the availability or functionality of some of the app's features. These considerations apply only to devices running Android 10 or later.

Ability to enable, disable, and configure Wi-Fi

• Wi-Fi networks can be added, deleted, and configured in the Administration Console of Kaspersky Security Center. When a Wi-Fi network is added to a policy, Kaspersky Endpoint Security receives this network configuration when it first connects to Kaspersky Security Center.
• When a device detects a network configured through Kaspersky Security Center, Kaspersky Endpoint Security prompts the user to connect to that network. If the user chooses to connect to the network, all of the settings configured through Kaspersky Security Center are automatically applied. The device then automatically connects to that network when in range, without showing further notifications to the user.
• If a user's device is already connected to another Wi-Fi network, sometimes the user may not be prompted to approve a network addition. In such cases, the user must turn Wi-Fi off and on again to receive the suggestion.
• When Kaspersky Endpoint Security suggests a user connect to a Wi-Fi network and the user refuses to do so, the app's permission to change the Wi-Fi state is revoked. Kaspersky Endpoint Security then cannot suggest connecting to Wi-Fi networks until the user grants the permission again by going to Settings → Apps & notifications → Special App access → Wi-Fi Control → Kaspersky Endpoint Security.
• Only open networks and networks encrypted with WPA2-PSK are supported. WEP and WPA encryption are not supported.
• If the password for a network previously suggested by the app is changed, the user must manually delete that network from the list of known networks. The device will then be able to receive a network suggestion from Kaspersky Endpoint Security and connect to it.
• When a device OS is updated from Android 9 or earlier to Android 10 or later, and/or Kaspersky Endpoint Security installed on a device running Android 10 or later is updated, the networks that were previously added via Kaspersky Security Center cannot be modified or deleted through Kaspersky Security Center policies. The user, however, can manually modify or delete such networks in the device settings.
• On devices running Android 10, a user is prompted for the password during an attempt to connect manually to a protected suggested network. Automatic connection does not require entering the password. If a user's device is connected to some other Wi-Fi network, the user must first disconnect from that network to connect automatically to one of the suggested networks.
• On devices running Android 11, a user may manually connect to a protected network suggested by the app, without entering the password.
• When Kaspersky Endpoint Security is removed from a device, the networks previously suggested by the app are ignored.
• Prohibiting use of Wi-Fi networks is not supported.

Camera access

• On devices running Android 10, use of the camera cannot be completely prohibited. Prohibiting use of the camera for a work profile is still available.
• If a third-party app attempts to access the device's camera, that app will be blocked, and the user will be notified about the issue. However, the apps that use the camera while running in background mode cannot be blocked.
• When an external camera is disconnected from a device, a notification about the camera not being available may be displayed in some cases.

Managing screen unlock methods

• Kaspersky Endpoint Security now resolves the password strength requirements into one of the system values: medium or high.
  • If the password length required is 1 to 4 symbols, then the app prompts the user to set a medium-strength password. It must be either numeric (PIN), with no repeating or ordered (e.g. 1234) sequences; or alphanumeric. The PIN or password must be at least 4 characters long.
  • If the password length required is 5 or more symbols, then the app prompts the user to set a high-strength password. It must be either numeric (PIN), with no repeating or ordered sequences; or alphanumeric (password). The PIN must be at least 8 digits long; the password must be at least 6 characters long.
• Using a fingerprint to unlock the screen can be managed for a work profile only.

Configuring restrictions for Android devices

To keep an Android device secure, configure the Wi-Fi, camera, and Bluetooth usage settings on the device.

By default, the user can use Wi-Fi, camera, and Bluetooth on the device without restrictions.

To configure the Wi-Fi, camera, and Bluetooth usage restrictions on the device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device Management section.
5. In the Restrictions section, configure usage of Wi-Fi, camera, and Bluetooth:
   • To disable the Wi-Fi module on the user's mobile device, select the Prohibit use of Wi-Fi check box.

     On personal devices and devices with a work profile running Android 10 or later, prohibiting the use of Wi-Fi networks is not supported.

   • To disable the camera on the user's mobile device, select the Prohibit use of camera check box.

     When camera usage is prohibited, the app displays a notification upon opening and then closes shortly after. On Asus and OnePlus devices, the notification is shown in full screen. The device user can tap the Close button to exit the app.

     On devices running Android 11 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If this is the case, you will not be able to restrict use of the camera.

   • To disable Bluetooth on the user's mobile device, select the Prohibit use of Bluetooth check box.

     On Android 12 or later, the use of Bluetooth can be disabled only if the device user granted the Nearby Bluetooth devices permission. The user can grant this permission during the Initial Configuration Wizard or at a later time.

     On personal devices running Android 13 or later, the use of Bluetooth cannot be disabled.

6. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Configuring iOS MDM device feature restrictions

Expand all | Collapse all

To ensure compliance with corporate security requirements, configure restrictions on the operation of the iOS MDM device. For information about available restrictions, refer to the context help of the administration plug-in.

To configure iOS MDM device feature restrictions:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Features Restriction section.
5. In the Features restriction settings section, select the Apply settings on device check box.
6. Configure iOS MDM device feature restrictions.

   List of feature restrictions

   Delay software updates, in days (supervised only, iOS 11.3+)

   Allows delaying operating system updates on the device.

   If the check box is selected, the user can't access updates for the specified period. The default delay is 30 days. You can specify another period in the Specify the number of days from 1 to 90 field.

   If the check box is cleared, the user can update the software as soon as updates are available.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Specify the number of days from 1 to 90

   Specifies the number of days to delay software updates. The default value is 30 days.

   This option is available if the Delay software updates, in days check box is selected.

   Allow use of camera

   Usage of the camera on the user's mobile device.

   If the check box is selected, the user is allowed to use the device camera.

   If the check box is cleared, the user device camera is disabled. The user cannot take photos, record videos, or use the FaceTime app. The camera icon on the device home screen is hidden.

   This check box is selected by default.

   Allow FaceTime (supervised only)

   Usage of the FaceTime app on the user's mobile device. This check box is available if the use of the device camera is allowed. This setting is available if the Allow use of camera check box is selected.

   If the check box is selected, the user can make and receive calls using FaceTime.

   If the check box is cleared, the FaceTime app is disabled on the user device. The user cannot make or receive video calls.

   This check box is selected by default.

   Allow screenshots and videos

   Capability to take a screenshot or video from the screen of the iOS MDM device.

   If the check box is selected, the user can take and save screenshots and videos from the screen of the mobile device.

   If the check box is cleared, the user cannot take and save screenshots and videos from the screen of the mobile device.

   This check box is selected by default.

   Allow screen observation by Classroom (supervised only)

   Capability for an instructor to view students' iPad screens using the Classroom application. For more details about the Classroom application, please visit the Apple Technical Support website.

   If the check box is selected, the instructor can view students' iPad screens in the Classroom application.

   If the check box is cleared, the instructor cannot view students' iPad screens in the Classroom application.

   This check box is selected by default.

   Allow modification of Personal Hotspot settings (supervised only, iOS 12.2+)

   If the check box is selected, the device user can modify Personal Hotspot settings.

   If the check box is cleared, the device user can't modify Personal Hotspot settings.

   The setting is available for mobile devices running iOS version 12.2 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow access to USB devices in Files app (supervised only, iOS 13.1+)

   If the check box is selected, the user can access connected USB devices in the Files app.

   If the check box is cleared, access to connected USB devices in the Files app is blocked.

   The setting is available for mobile devices running iOS version 13.1 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Enable USB Restricted Mode while device is locked (supervised only, iOS 11.4.1+)

   Specifies whether USB Restricted Mode is enabled when the device is locked.

   If the check box is selected, when locked, the device connection to USB drives is limited via USB Restricted Mode.

   If the check box is cleared, the device is allowed to connect to USB drives when locked.

   The setting is available for mobile devices running iOS version 11.4.1 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Force Wi-Fi on (supervised only, iOS 13.0+)

   Specifies whether Wi-Fi on the managed device should be always on. The device can connect to any Wi-Fi network.

   If the check box is selected, Wi-Fi on the device is always on, even in flight mode. The user can't disable Wi-Fi in the device settings.

   If the check box is cleared, the user can disable Wi-Fi in the device settings.

   The setting is available for mobile devices running iOS version 13.0 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Force connection to allowed Wi-Fi networks only (supervised only, iOS 14.5+)

   Specifies whether the device can connect to allowed Wi-Fi networks only. This option is available if you add at least one Wi-Fi network to the list of Wi-Fi networks in the Wi-Fi section.

   If the check box is selected, the device connects to allowed Wi-Fi networks only. The user can't disable Wi-Fi in the device settings.

   If the check box is cleared, the user can connect to any Wi-Fi network.

   The setting is available for mobile devices running iOS version 14.5 or later and iPadOS version 13.1 or later.

   This check box is cleared by default.

   Allow creating VPN configurations (supervised only, iOS 11+)

   If the check box is selected, the user can create a VPN configuration on the managed device.

   If the check box is cleared, the user can't create a VPN configuration on the managed device.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow AirDrop (supervised only)

   Use of the AirDrop feature for transmitting user data from the iOS MDM device to other Apple devices.

   If the check box is selected, the user can use AirDrop to transmit data to other Apple devices.

   If the check box is cleared, the user cannot transmit data to other Apple devices using AirDrop.

   This check box is selected by default.

   Allow modification of eSIM settings (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can change settings related to the carrier plan.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow iMessage (supervised only)

   Usage of the iMessage service on the user's mobile device.

   If the check box is selected, the user can send and receive messages using the iMessage service.

   If the check box is cleared, the iMessage is not available on the mobile device. The user cannot send or receive messages via iMessage.

   This check box is selected by default.

   Allow Apple Music (supervised only)

   Listening to music on the user's mobile device using the Apple Music service.

   If the check box is selected, the user can listen to music on the mobile device in the Music app.

   If the check box is cleared, the Apple Music service is not available to the user.

   This check box is selected by default.

   Allow Radio in Apple Music (supervised only)

   Listening to the radio using the Apple Music service on the user's mobile device.

   If the check box is selected, the user can listen to the radio in the Music app on the mobile device.

   If the check box is cleared, the user cannot listen to the radio.

   This check box is selected by default.

   Allow modification of Bluetooth settings (supervised only, iOS 11+)

   If the check box is selected, the user can modify Bluetooth settings on the mobile device.

   If the check box is cleared, Bluetooth settings cannot be modified on the mobile device.

   The setting is available for mobile devices running iOS version 11 or later and iPadOS version 13.1 or later.

   This check box is selected by default.

   Allow use of NFC (supervised only, iOS 14.2+)

   If the check box is selected, the use of NFC is allowed.

   If the check box is cleared, the use of NFC is disabled.

   The setting is available for mobile devices running iOS version 14.2 or later.

   This check box is selected by default.

   Allow voice dialing on a locked device

   Use of the voice dialing function on a locked mobile device.

   If the check box is selected, the user can use voice commands to dial phone numbers on a locked mobile device.

   If the check box is cleared, the user cannot use voice commands to dial phone numbers on a locked mobile device.

   This check box is selected by default.

   Allow use of Siri

   Usage of the Siri app on the user's mobile device.

   If the check box is selected, the user can use voice commands of the Siri app on the mobile device.

   If the check box is cleared, the user cannot use voice commands of the Siri app on the mobile device.

   This check box is selected by default.

   Allow use of profanity filter (supervised only)

   This option enables the filtering of profanity while using the Siri app on the mobile device.

   If the check box is selected, profanity is filtered while the user uses the Siri app.

   If the check box is cleared, profanity is not filtered while the user uses the Siri app.

   This check box is selected by default.

   Allow when device is locked

   Use of Siri voice commands when the user's mobile device is locked. The user's mobile device has to be password-protected. This setting is available if the Allow use of Siri check box is selected.

   If the check box is selected, the user can use Siri voice commands on a locked mobile device.

   If the check box is cleared, the user cannot use Siri voice commands on a locked device.

   This check box is selected by default.

   Show user's content (supervised only)

   This option allows adding personal data of the user to Siri so they can be used in Siri voice commands (for example: "remind me to call wife when I get home") on the iOS MDM device. This setting is available if the Allow use of Siri check box is selected.

   If the check box is selected, the user can fill out a personal card in Siri settings and use this information in Siri voice commands.

   If the check box is cleared, the user is not allowed to add personal data to Siri.

   This check box is selected by default.

   Allow AirPrint (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can use AirPrint.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow storage of AirPrint credentials (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether the device user can store a keychain of user name and password for AirPrint.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Allow iBeacon discovery of AirPrint printers (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether iBeacon discovery of AirPrint printers is enabled. Disabling iBeacon discovery of AirPrint printers prevents spurious AirPrint Bluetooth beacons from getting information about network traffic.

   The restriction is supported on devices with iOS 11 and later.

   The check box is selected by default.

   Force AirPrint to use a trusted TLS certificate (supervised only, iOS 11+)

   Selecting or clearing this check box specifies whether a trusted certificate is required for TLS printing communication.

   The restriction is supported on devices with iOS 11 and later.

   The check box is cleared by default.

   Allow iBooks Store (supervised only)

   Access to iBooks Store from the iBooks app on the user's mobile device.

   If the check box is selected, the user can visit iBooks Store from the iBooks app installed on the device.

   If the check box is cleared, the user cannot visit iBooks Store from the iBooks app.

   This check box is selected by default.

   Allow installation of apps from Apple Configurator and iTunes (supervised only)

   The user can independently install apps on an iOS MDM device.

   If the check box is selected, the user can independently install or update apps on a mobile device from App Store using iTunes, Apple Configurator, or Kaspersky Device Management for iOS.

   If the check box is cleared, the user cannot install or update apps from App Store using iTunes, Apple Configurator, or Kaspersky Device Management for iOS on a mobile device. Installation and upgrade are available only for corporate apps. The App Store icon is hidden on the home screen of the iOS MDM device.

   This check box is selected by default.

   Allow installation of apps from App Store (supervised only)

   Capability to independently install apps to a mobile device from App Store. The check box is available if the Allow installation of apps from Apple Configurator and iTunes check box is selected.

   If the check box is selected, the user can independently install or update apps from App Store.

   If the check box is cleared, the user cannot install or update apps from App Store on the mobile device. The App Store icon is hidden on the home screen of the iOS MDM device.

   This check box is selected by default.

   Allow automatic loading of apps (supervised only)

   Use of the function for automatic loading of apps to the user's mobile device. The check box is available if the Allow installation of apps from Apple Configurator and iTunes and Allow installation of apps from App Store check boxes are selected.

   If the check box is selected, automatic loading of apps is available to the user (Settings > iTunes and App Store > Applications). After this function is enabled, the apps that the user acquired from App Store are automatically loaded to the user's other Apple devices.

   If the check box is cleared, the function for automatic loading of apps is disabled and unavailable.

   This check box is selected by default.

   Allow removing apps (supervised only)

   This option allows removing apps from the mobile device.

   If the check box is selected, the user can remove apps installed via App Store or iTunes from the device.

   If the check box is cleared, the user cannot remove apps installed via App Store or iTunes from the mobile device.

   This check box is selected by default.

   Allow In-App Purchases

   Use of the in-App Purchase system on the mobile device.

   If the check box is selected, the user can make purchases in apps installed on the mobile device.

   If the check box is cleared, the user cannot make purchases in apps installed on the mobile device.

   This check box is selected by default.

   Prompt for password for each purchase through iTunes Store

   Use of the restriction password for purchasing media content in iTunes Store.

   If the check box is selected, prior to making the first purchase via iTunes Store the user has to specify the restriction password in purchase restriction settings and subsequently use it for preventing accidental or unauthorized purchases. After the account has been verified when the user is making purchases, the restriction password does not have to be re-entered for another 15 minutes.

   If the check box is cleared, the user is not required to enter the restriction password before making purchases in iTunes Store.

   This check box is cleared by default.

   Allow backup in iCloud

   Automatic data backup from the iOS MDM device to iCloud. Copies of data already stored in iCloud are not created during the backup process. Copies of media content that was received by synchronizing the device with a computer and not purchased from iTunes Store are not created either.

   If the check box is selected, the user can save backup copies of mobile device data in iCloud. Backup copies of data are saved in iCloud on a daily basis when the device is enabled, locked, and connected to a power source.

   If the check box is cleared, the user cannot save backup copies of mobile device data in iCloud.

   This check box is selected by default.

   Allow storing documents and data in iCloud (supervised only)

   Automatic backup of documents in iCloud. iCloud documents can be opened and edited on other devices on which the iCloud service is configured.

   If the check box is selected, the user can save documents in iCloud, open and edit them on other devices in applications that support iCloud (such as TextEdit).

   If the check box is cleared, the user is not allowed to save documents in iCloud.

   This check box is selected by default.

   Allow iCloud keychain

   Automatic synchronization of the account credentials of an iOS MDM device user with other Apple devices of the user. Data to be synchronized is stored in iCloud Keychain. Data in iCloud Keychain is encrypted. iCloud Keychain makes it possible to save the following data in iCloud:

   • Website accounts
   • Bank card numbers and expiry dates
   • Wireless network passwords

   If the check box is selected, the user can synchronize data of accounts with other Apple devices of the user.

   If the check box is cleared, the user is not allowed to use iCloud Keychain on the mobile device.

   This check box is selected by default.

   Allow managed apps to store data in iCloud

   Creation of a backup copy of the data of managed apps in iCloud. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS.

   If the check box is selected, the user can store the data of managed apps in iCloud.

   If the check box is cleared, the user cannot store corporate data in iCloud.

   This check box is selected by default.

   Allow backup of enterprise books

   Backup copying of enterprise books using iCloud or iTunes. You can provide access to enterprise books by placing them on the corporate web server.

   If the check box is selected, backup copying of enterprise books using iCloud or iTunes is available to the user.

   If the check box is cleared, backup copying of enterprise books is not available.

   This check box is selected by default.

   Allow synchronization of notes and highlights in enterprise books

   Capability to synchronize notes, bookmarks, and highlighted text in enterprise books using iCloud.

   If the check box is selected, the user can perform synchronization of notes, bookmarks, and highlights in enterprise books (Settings > iBooks > Sync bookmarks and notes). Changes will be available on all the user's Apple devices using iCloud.

   If the check box is cleared, notes, bookmarks and highlighted text will be available only on this mobile device.

   This check box is selected by default.

   Allow iCloud photo sharing

   Use of iCloud photo sharing on the iOS MDM device to grant other users access to photos and videos on the iCloud server. The other uses need to have the iCloud Photo Sharing feature configured.

   If the check box is selected, the iCloud Photo Sharing feature is available to the user. Users of other devices can view the user's photos and videos, leave comments, and add their own photos and videos. The user can also access data of other users on the iCloud server.

   If the check box is cleared, the iCloud Photo Sharing feature is not available to the user. The user cannot grant other uses access to the user's photos and videos on the iCloud server or access data of other users on the iCloud server.

   This check box is selected by default.

   Allow iCloud Media Library

   Use of the iCloud Media Library function for automatic uploading of photos and videos from the iOS MDM device to other Apple devices of the user.

   If the check box is selected, the iCloud Media Library function is available to the user when working with the Photo app.

   If the check box is cleared, the iCloud Media Library function is not available to the user. The user's photos and videos saved in the iCloud Media Library are removed from the iCloud server.

   This check box is selected by default.

   Allow My Photo Stream (disallowing may result in loss of data)

   Use of the Allow My Photo Stream feature for automatic uploading of photos and videos from the iOS MDM device to other Apple devices of the user. The photos and videos are stored in the My Photo Stream folder on the iCloud server for 30 days.

   If the check box is selected, the user has access to the My Photo Stream feature when using the iPhoto or Aperture apps.

   If the check box is cleared, the user is not allowed access to the My Photo Stream feature. The user's photos and videos saved in the My Photo Stream folder are removed from the iCloud server.

   This check box is selected by default.

   Allow automatic sync while roaming

   Automatic synchronization of user data when the iOS MDM device is roaming.

   If the check box is selected, the user can enable automatic data synchronization when the device is roaming. Enabling automatic synchronization in roaming can result in unexpected mobile service costs.

   If the check box is cleared, the user is not allowed to use automatic data synchronization when the device is roaming.

   This check box is selected by default.

   Enable encryption of backup copies

   Encryption of backup copies of iOS MDM device data in the iTunes app on the user's computer.

   Data of the Kaspersky Device Management for iOS configuration policy is not encrypted regardless of whether or not encryption of the backup copy of data is enabled.

   If the check box is selected, when a backup copy of mobile device data is created in the iTunes app, data is encrypted automatically and protected with a password. In this case, the user cannot encrypt backup copies of device data in the iTunes app.

   If the check box is cleared, the user may choose whether or not to use encryption of backup copies of data in the iTunes app.

   This check box is cleared by default.

   Limit ad tracking

   Use of IFA (Identifier for advertisers) technology for keeping track of websites visited and apps launched on the iOS MDM device. IFA makes it possible to configure ad tracking on the mobile device according to the user's interests.

   If the check box is selected, IFA technology is disabled on the user's mobile device.

   If the check box is cleared, IFA technology is enabled on the mobile device and keeps track of websites visited and apps started in order to show targeted ads.

   This check box is cleared by default.

   Allow full reset (supervised only)

   Capability to wipe all data from the device and reset the device to its factory settings.

   If the check box is selected, the user can wipe all data from the device and reset it to factory settings (Settings > General > Reset > Wipe content and settings).

   If the check box is cleared, full reset to factory settings is not available.

   This check box is selected by default.

   Allow users to accept untrusted TLS certificates

   Use of untrusted TLS certificates for providing an encrypted communication channel between apps on the iOS MDM device (Mail, Contacts, Calendar, Safari) and corporate resources.

   If the check box is selected, the user may allow the use of an untrusted TLS certificate after being shown a warning.

   If the check box is cleared, Kaspersky Device Management for iOS automatically blocks the use of untrusted TLS certificates.

   This check box is selected by default.

   Allow automatic updates of trusted certificates

   Automatic update of trusted certificates on the iOS MDM device.

   If the check box is selected, Kaspersky Device Management for iOS automatically applies changes made to the trust settings of a certificate.

   If the check box is cleared, changes to trust settings of a certificate are not applied automatically. After being shown a warning, the user may choose to apply changes to trust settings of the certificate.

   This check box is selected by default.

   Allow trusting of new enterprise developers

   Capability to configure trusting of corporate apps on a mobile device. You can develop corporate apps and distribute them among employees for internal use. To work with a corporate app, the mobile device user must make it a trusted app. When installing apps via Kaspersky Device Management for iOS, the trust level of apps is automatically set.

   If the check box is selected, the user can configure trusting of corporate apps (Settings > General > Profiles or Profiles and device management).

   If the check box is cleared, the user cannot set the trust level for corporate apps when installing an app manually. You can install apps only through Kaspersky Device Management for iOS. The trust level of apps will be set automatically.

   This check box is selected by default.

   Allow installing configuration profiles (supervised only)

   Use of additional configuration profiles (other than Kaspersky Security Center policies) on the iOS MDM device.

   If the check box is selected, the user can install additional configuration profiles on the mobile device.

   If the check box is cleared, the user cannot install additional configuration profiles, other than Kaspersky Security Center policies, on the mobile device.

   This check box is selected by default.

   Allow editing account settings (supervised only)

   The option that lets the user add new accounts (such as email accounts) and edit account settings on the iOS MDM device.

   If the check box is selected, the mobile device user can add new accounts and edit the settings of existing accounts.

   If the check box is cleared, the mobile device user is not allowed to add new accounts and edit the settings of existing accounts.

   This check box is selected by default.

   Allow modification of cellular communication settings (supervised only)

   Capability to configure cellular network data transfer by apps installed on a mobile device.

   If the check box is selected, the user can configure the settings for data transfer over a cellular network (Settings > Cellular communications > Cellular data for apps).

   If the check box is cleared, the settings for cellular network data transfer by apps cannot be modified.

   This check box is selected by default.

   Allow device name editing (supervised only)

   Capability to modify the name of the mobile device.

   If the check box is selected, the user can edit the mobile device name (Settings > General > About this device > Name).

   If the check box is cleared, the device name cannot be edited.

   This check box is selected by default.

   Allow use of Find My Device in the Find My app (supervised only, iOS 13+)

   Selecting or clearing this check box specifies whether the device user can use Find My Device in the Find My app.

   The restriction is supported on devices with iOS 13 and later.

   The check box is selected by default.

   Allow use of Find My Friends in the Find My app (supervised only, iOS 13+)

   Selecting or clearing this check box specifies whether the device user can use Find My Friends in the Find My app.

   The restriction is supported on devices with iOS 13 and later.

   The check box is selected by default.

   Allow editing Find My Friends settings (supervised only)

   The option that lets the user edit the settings of the Find My Friends app on the iOS MDM device.

   If the check box is selected, the user can edit the settings of the Find My Friends app on the iOS MDM device.

   If the check box is cleared, the user cannot edit the configured settings of the Find My Friends app on the iOS MDM device.

   This check box is selected by default.

   Allow editing of notification settings (supervised only)

   Capability to configure the display of notifications on the mobile device.

   If the check box is selected, the user can configure the settings for displaying notifications on the mobile device (Settings > General > Notifications).

   If the check box is cleared, the display of notifications cannot be configured.

   This check box is selected by default.

   Allow password change (supervised only)

   Capability to set, change, or delete the mobile device unlock password.

   If the check box is selected, the user can set, change, or delete the password used for unlocking the mobile device (Settings > Password).

   If the check box is cleared, management of the device unlock password is not available.

   This check box is selected by default.

   Allow modification of Touch ID and Face ID (supervised only)

   Capability to add and remove Touch ID fingerprints or Face ID data. This setting is available if the Allow password change check box is selected.

   You can manage Face ID on devices running iOS version 11.0 or later.

   If the check box is selected, the user can add and remove Touch ID fingerprints or Face ID data (Settings > Touch ID & Passcode / Face ID & Passcode > Fingerprints).

   If the check box is cleared, Touch ID fingerprint or Face ID data management is not available.

   This restriction cannot be applied on iPad devices.

   This check box is selected by default.

   Allow modification of restrictions (supervised only)

   Capability to configure the settings for restrictions on the mobile device. Restrictions may be utilized by the user to perform parental control functions on the mobile device. The user can restrict device functions (for example, block use of the camera), access to media content (for example, set age restrictions on viewing films), use of apps (for example, block the use of iTunes Store), and configure other restrictions.

   If the check box is selected, the user can configure the settings for restrictions on the mobile device (Settings > General > Restrictions).

   If the check box is cleared, restrictions cannot be configured on the mobile device.

   This check box is selected by default.

   Allow wallpaper change (supervised only)

   Capability to select the image that will be displayed on the lock screen or Home screen.

   If the check box is selected, the user can select the wallpaper for the mobile device.

   If the check box is cleared, wallpaper selection is not available.

   This check box is selected by default.

   Allow non-configurator hosts (supervised only)

   Protection of the iOS MDM device against third-party connections. A third-party connection is a connection to other devices or synchronization with Apple services, such as iTunes.

   If the check box is selected, the user can synchronize the iOS MDM device with other devices and Apple services.

   If the check box is cleared, Kaspersky Device Management for iOS blocks non-Configurator hosts on the user's mobile device.

   This check box is selected by default.

   Allow non-managed apps to use documents from managed apps

   Possibility to use unmanaged (personal) apps on the iOS MDM device to open documents created using managed (corporate) apps and accounts. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, the user can open documents created managed corporate apps in unmanaged apps.

   If the check box is cleared, the user is not allowed to open documents created using managed apps in unmanaged apps. For example, this setting prevents the opening of a confidential email attachment from a managed email account in personal apps of the user.

   This check box is selected by default.

   Allow managed apps to use documents from non-managed apps

   Possibility to use managed (corporate) apps on the iOS MDM device to open documents created using unmanaged (personal) apps and accounts of the user. Managed apps are corporate apps that are installed, configured, and managed using Kaspersky Device Management for iOS. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, the user can open documents created using unmanaged apps in managed apps.

   If the check box is cleared, the user is not allowed to open documents created using unmanaged apps in managed apps. For example, this setting prevents a document from a personal iCloud account from being opened in a corporate app.

   This check box is selected by default.

   Treat AirDrop as unmanaged app

   Use of AirDrop as an unmanaged app for transferring data from the mobile device to other Apple devices. This restriction requires that you clear the Allow non-managed apps to use documents from managed apps check box. Unmanaged apps are apps installed, configured, and managed by the mobile device user.

   If the check box is selected, AirDrop is treated as an unmanaged app.

   If the check box is cleared, AirDrop is treated as a managed app.

   This check box is selected by default.

   Allow Handoff

   Use of the Handoff function on the user's mobile device. Handoff enables you to start working with data on one Apple device and then switch to another Apple device and continue working with that data.

   If the check box is selected, Handoff is available to the user.

   If the check box is cleared, Handoff is not available.

   This check box is selected by default.

   Allow Spotlight suggestions (supervised only)

   Use of Spotlight suggestions for the Search function on the user's mobile device. Spotlight enables you to show search results from the Internet, iTunes Store, App Store, and other sources when using the Search function. When using Spotlight suggestions, search queries and their associated user data are sent to Apple.

   If the check box is selected, the user can allow Spotlight suggestions to be added to the Search function (Settings > General > Spotlight search > Spotlight suggestions).

   If the check box is cleared, Spotlight suggestions are not available. User data is not sent to Apple.

   This restriction cannot be applied on iPadOS devices.

   This check box is selected by default.

   Allow diagnostic and personal data to be sent to Apple

   Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with such data to Apple for analysis.

   If the check box is selected, after being shown a warning the user may allow transmission of reports with diagnostic data and information on mobile device usage to Apple.

   If the check box is cleared, Kaspersky Device Management for iOS blocks transmission of reports with diagnostic data and information on mobile device usage to Apple.

   This check box is selected by default.

   Allow modification of diagnostic data transmission settings (supervised only)

   Automatic receiving of diagnostic data and information on iOS MDM device usage and transmission of a report with such data to Apple for analysis. This setting is available if the Allow diagnostic and personal data to be sent to Apple check box is selected.

   If the check box is selected, the user can configure the submission of reports containing diagnostic information and mobile device usage data to Apple (Settings > Confidentiality > Diagnostics and usage).

   If the check box is cleared, the settings for submission of reports containing diagnostic information are not available.

   This check box is selected by default.

   Allow device unlock using Touch ID and Face ID

   Use of Touch ID and Face ID technologies make it possible to use a fingerprint or facial recognition as a password for unlocking the iOS MDM device. Touch ID and Face ID can also be used for authentication of purchases by means of Apple Pay, iTunes Store, App Store, iBooks Store and to sign in into apps.

   You can manage Face ID on devices running iOS version 11.0 or later.

   If the check box is selected, the user can use a fingerprint or facial recognition instead of a password for unlocking the mobile device.

   If the check box is cleared, the user cannot use Touch ID or Face ID technology for unlocking the mobile device.

   This check box is selected by default.

   Enable Apple Watch wrist detection

   Automatic locking of Apple Watch when the user removes the watch from his or her hand.

   If the check box is selected, Apple Watch is locked when the user removes a watch from his or her hand (Apple Watch > My watch > General > Wrist detection). To unlock it, the user must enter a password on the mobile device.

   If the check box is cleared, Apple Watch cannot be locked after a watch is removed.

   This check box is selected by default.

   Allow pairing with Apple Watch (supervised only)

   Pairing of Apple Watch with a controlled mobile device.

   If the check box is selected, the user of the controlled mobile device can create a pairing with Apple Watch.

   If the check box is cleared, pairing with Apple Watch is not available.

   This check box is selected by default.

   Prompt for password on first connection via AirPlay

   Use of a password upon connection of the iOS MDM device to devices compatible with AirPlay. The password is used for safe transmission of media content.

   If the check box is selected, before the first connection of the mobile device to devices compatible with AirPlay, the user must specify the password in the AirPlay security settings and subsequently enter it.

   If the check box is cleared, the user is free to decide whether or not to use a password when connecting the mobile device to devices compatible with AirPlay.

   This check box is cleared by default.

   Allow predictive keyboard (supervised only)

   Use of the predictive text input function. The predictive text input function shows options for completing words and suggestions based on available dictionaries.

   If the check box is selected, the user can enable and use the predictive text input function (Settings > General > Keyboard > Predictive text).

   If the check box is cleared, the predictive text function is not available. In this case, suggestions are not displayed when entering text.

   This check box is selected by default.

   Allow keyboard shortcuts (supervised only)

   Use of keyboard shortcuts for quick access to mobile device functions.

   If the check box is selected, the user can enable the keyboard shortcut function and use it when working with the mobile device (Settings > General > Universal access > Keyboard shortcut).

   If the check box is cleared, the keyboard shortcut function is not available.

   This check box is selected by default.

   Allow auto correction (supervised only)

   Use of the auto correction function when entering text.

   If the check box is selected, the user can enable and use the auto correction function (Settings > General > Keyboard > Auto correction).

   If the check box is cleared, auto correction is not available when entering text.

   This check box is selected by default.

   Allow spellcheck (supervised only)

   Use of spellcheck when entering text on a mobile device. The spellcheck function underlines incorrectly spelled words and suggests corrections.

   If the check box is selected, the user can enable and use the spellcheck function (Settings > General > Keyboard > Spellcheck).

   If the check box is cleared, spellcheck is not available when entering text.

   This check box is selected by default.

   Allow dictionary search (supervised only)

   Obtaining the definition of a word in a dictionary on the mobile device. Only a software keyboard has a dictionary function.

   If the check box is selected, the user can highlight any word on the screen of the mobile device and receive the definition of that word.

   If the check box is cleared, dictionary search is not available.

   This check box is selected by default.

   Allow Wallet on-screen notifications when screen is locked

   Use of Wallet notifications on the lock screen of the iOS MDM device.

   If the check box is selected, Wallet notifications are displayed on the lock screen of the mobile device.

   If the check box is cleared, Wallet notifications are not displayed on the lock screen of the mobile device. To work with Wallet, the user must unlock the device.

   This check box is selected by default.

   Show Control Center when screen is locked

   Possibility to go to the Control Center of the iOS MDM device when the device is locked.

   If the check box is selected, the user can go to the Control Center by swiping the lock screen up.

   If the check box is cleared, the user cannot go to the Control Center when the device is locked.

   This check box is selected by default.

   Show Notification Center when screen is locked

   Possibility to go to the Notification Center of the iOS MDM device when the device is locked.

   If the check box is selected, the user can go to the Notification Center by swiping the lock screen down.

   If the check box is cleared, the user cannot go to the Notification Center when the device is locked.

   This check box is selected by default.

   Show Today when screen is locked

   Display of information from the Today section of the Notification Center on the screen of a locked iOS MDM device. The Today section of the Notification Center shows the following information:

   • Planned Calendar events
   • Reminders
   • Stock prices
   • Weather

   If the check box is selected, the user can view notifications from the Today section of the Notification Center on a locked mobile device.

   If the check box is cleared, the Today section is not displayed on the locked mobile device.

   This check box is selected by default.

7. Click the Apply button to save the changes you have made.
8. Select the Restrictions for applications section.
9. In the Applications restriction settings section, select the Apply settings on device check box.
10. Configure restrictions for apps on the iOS MDM device.
11. Click the Apply button to save the changes you have made.
12. Select the Restrictions for Media Content section.
13. In the Media content restriction settings section, select the Apply settings on device check box.
14. Configure restrictions for media content on the iOS MDM device.
15. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, restrictions on features, apps, and media content will be configured on the user's mobile device.

Configuring user access to websites

This section contains instructions on how to configure access to websites on Android and iOS devices.

Configuring access to websites on Android devices

You can use Web Protection to configure access of Android device users to websites. Web Protection supports website filtering by categories defined in Kaspersky Security Network cloud service. Filtering allows you to restrict user access to certain websites or categories of websites (for example, those from the "Gambling, lotteries, sweepstakes", or "Internet communication" categories). Web Protection also protects the personal data of users on the internet.

To enable Web Protection:

• The Statement regarding data processing for the purpose of using Web Protection (Web Protection Statement) must be accepted. Kaspersky Endpoint Security uses Kaspersky Security Network (KSN) to scan websites. The Web Protection Statement contains the terms of data exchange with KSN.

  You can accept the Web Protection Statement for the user in Kaspersky Security Center. In this case, the user is not required to take any action.

  If you have not accepted the Web Protection Statement and prompt the user to do this, the user must read and accept the Web Protection Statement in the app settings.

  If you have not accepted the Web Protection Statement, Web Protection is not available.

Web Protection on Android devices is supported only by Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser.

If the Kaspersky Endpoint Security for Android app in device owner mode is not enabled as an Accessibility Features service, Web Protection is supported only by the Google Chrome browser and checks only the domain of a website. To allow other browsers (Samsung Internet Browser, Yandex Browser, and HUAWEI Browser) support Web Protection, enable Kaspersky Endpoint Security as an Accessibility Features service. This will also enable the Custom Tabs feature operation.

The Custom Tabs feature is supported by Google Chrome, HUAWEI Browser, and Samsung Internet Browser.

Web Protection for HUAWEI Browser, Samsung Internet Browser, and Yandex Browser does not block sites on a mobile device if a work profile is used and Web Protection is enabled only for the work profile.

Web Protection is enabled by default: user access to websites in the Phishing and Malware categories is blocked. On devices managed by the Kaspersky Endpoint Security for Android app in device owner mode, Web Protection is supported only by the Google Chrome browser and checks only the domain of a website. To allow other browsers (Samsung Internet Browser, Yandex Browser, and HUAWEI Browser) to support Web Protection, Kaspersky Endpoint Security must be enabled as an Accessibility Features service.

To configure the settings of the device user's access to websites:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Web Protection.
5. To use Web Protection, you or device user must read and accept the Statement regarding data processing for the purpose of using Web Protection (Web Protection Statement):
   1. Click the Web Protection Statement link at the top of the section.

      This opens Statement regarding data processing for purpose of using Web Protection window.

   2. Read and accept Privacy Policy by selecting the corresponding check box. To view Privacy Policy, click the Privacy Policy link.

      If you do not accept Privacy Policy, mobile device user can accept Privacy Policy in the Initial Configuration Wizard or in the app ( → About → Terms and conditions → Privacy Policy).

   3. Select the Web Protection Statement acceptance mode:
      • I have read and accept the Web Protection Statement
      • Request acceptance of the Web Protection Statement from the device user
      • I do not accept the Web Protection Statement

        If you select I do not accept the Web Protection Statement, the Web Protection does not block sites on a mobile device. Mobile device user cannot enable Web Protection in the Kaspersky Endpoint Security.

   4. Click OK to close the window.

   

   Step 5. Accept the Statement regarding data processing for purpose of using Web Protection.

6. Select the Enable Web Protection check box.
7. If you want the app to check a full URL when opening a website in Custom Tabs, select the Check full URL when using Custom Tabs check box.

   Custom Tabs is an in-app browser that allows the user to view web pages without having to leave the app and switch to a full web browser version. This option provides better detection of a URL and its check against the configured Web Protection rules. If the check box is selected, Kaspersky Endpoint Security for Android opens the website in a full version of the browser and checks whole web address of the website. If the check box is cleared, Kaspersky Endpoint Security for Android checks only the domain of a website in Custom Tabs.

8. Select one of the following options:
   • If you want the app to restrict user access to websites depending on their content, do the following:
     1. In the Web Protection section, in the drop-down list select Websites of selected categories are forbidden.
     2. Create a list of blocked categories by selecting check boxes next to the categories of websites to which the app will block access.

   

   Step 8. Web Protection section. Select the categories of websites to block access to.

   • If you want the app to allow or restrict user access only to websites specified by the administrator, do the following:
     1. In the Web Protection section, in the drop-down list select Only listed websites are allowed or Only listed websites are blocked.

        If Kaspersky Endpoint Security for Android is not set as an Accessibility feature, Web Protection may block an allowed website that loads some elements from a website with a domain that is not in the list of allowed domains.

     2. Create a list of websites by adding addresses of websites to which the app will allow or block access, depending on the value selected in the drop-down list. You can add websites by link (full URL, including the protocol, e.g. https://example.com).

        To make sure that the app allows or blocks access to the specified website in all supported versions of Google Chrome, HUAWEI Browser, Samsung Internet Browser, and Yandex Browser, include the same URL twice, once with the HTTP protocol (e.g., http://example.com) and once with the HTTPS protocol (e.g., https://example.com).

        For example:

        • https://example.com—The main page of the website is either allowed or blocked. This URL can only be accessed through the HTTPS protocol.
        • http://example.com—The main page of the website is either allowed or blocked, but only when accessed through the HTTP protocol. Other protocols like HTTPS are not affected.
        • https://example.com/page/index.html—Only the index.html page of the website will be allowed or blocked. The rest of the website is not affected by this entry.

        The app also supports regular expressions. When entering the address of an allowed or blocked website, use the following templates:

        • https://example\.com/.*—This template blocks or allows all child pages of the website, accessed via the HTTPS protocol (for example, https://example.com/about).
        • https?://example\.com/.*—This template blocks or allows all child pages of the website, accessed via both the HTTP and HTTPS protocols.
        • https?://.*\.example\.com—This template blocks or allows all subdomain pages of the website (e.g., https://pictures.example.com).
        • https?://example\.com/[abc]/.*—This template blocks or allows all child pages of the website where the URL path begins with 'a', 'b', or 'c' as the first directory (e.g., https://example.com/b/about).
        • https?://\w{3,5}.example\.com/.*—This template blocks or allows all child pages of the website where the subdomain consists of a word with 3 to 5 characters (e.g., http://abde.example.com/about).

        Use the expression https? to select both the HTTP and HTTPS protocols. For more details on regular expressions, please refer to the Oracle Technical Support website.

   

   Step 9. Web Protection section. Specify the list of websites to allow access to.

   • If you want the app to block user access to all websites, in the Web Protection section, in the drop-down list, select All websites are blocked.
9. To lift content-based restrictions on user access to websites, clear the Enable Web Protection check box.
10. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Managing the website list

You can manage the list of websites with the following buttons:

• Add - Click to add a website to the list by entering a URL or regular expression.
• Import - Click to add multiple websites to the list by specifying a TXT file which contains the required URLs or regular expressions. The file must be encoded in UTF-8. URLs or regular expressions in the file must be separated by semicolons or by line breaks.
• Edit - Click to change the address of a website.
• Delete - Click to remove a website from the list. To remove multiple websites from the list, select them with the CTRL+A, CTRL+left-click, or SHIFT+left-click hotkeys, and then click Delete.

Configuring access to websites on iOS MDM devices

Configure Web Protection settings to control access to websites for iOS MDM device users. Web Protection controls a user's access to websites based on lists of allowed and blocked websites. Web Protection also lets you add website bookmarks on the bookmark panel in Safari.

By default, access to websites is not restricted.

If a URL is redirected to a different website, Web Protection checks only the redirect target.

Web Protection settings can be configured for supervised devices only.

To configure access to websites on the user's iOS MDM device:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Web Protection section.
5. In the Web Protection settings section, select the Apply settings on device check box.
6. To block access to blocked websites and allow access to allowed websites:
   1. In the Web Filter Mode drop-down list, select the Limit adult content mode.
   2. In the Allowed websites section, create a list of allowed websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS allows access to all websites in the domain. For example, if you have added http://www.example.com to the list of allowed websites, access is allowed to http://pictures.example.com and http://example.com/movies. If the list of allowed websites is empty, the application allows access to all websites other than those included in the list of blocked websites.

   3. In the Forbidden websites section, create a list of blocked websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS blocks access to all websites in the domain.

7. To block access to all websites other than allowed websites on the tab list:
   1. In the Web Filter Mode drop-down list, select the Allow bookmarked websites only mode.
   2. In the Bookmarks section, create a list of bookmarks of allowed websites.

      The website address should begin with "http://" or "https://". Kaspersky Device Management for iOS allows access to all websites in the domain. If the bookmark list is empty, the application allows access to all websites. Kaspersky Device Management for iOS adds websites from the list of bookmarks on the bookmarks tab in Safari in the user's mobile device.

8. Click the Apply button to save the changes you have made.

As a result, once the policy is applied, Web Protection will be configured on the user's mobile device according to the mode selected and lists created.

Compliance control

This section contains instructions on how to monitor device compliance with corporate requirements and how to configure compliance control rules.

Compliance control of Android devices with corporate security requirements

You can control Android devices for compliance with the corporate security requirements. Corporate security requirements regulate how the user can work with the device. For example, the real-time protection must be enabled on the device, the anti-malware databases must be up-to-date, and the device password must be sufficiently strong. Compliance control is based on a list of rules. A compliance rule includes the following components:

• Device check criterion (for example, absence of blocked apps on the device).
• Time period allocated for the user to fix the non-compliance (for example, 24 hours).
• Actions that will be taken on the device if the user does not fix the non-compliance within the set time period (for example, lock the device).

  If the device is in battery saver mode, the app may perform this task later than specified. To ensure timely responses of KES devices on Android to the administrator's commands, enable the use of Firebase Cloud Messaging.

To create a rule for checking devices for compliance with a group policy:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Compliance Control section.
5. To receive notifications about devices that do not comply with the policy, in the Non-compliance notifications section select the Notify administrator check box.

   If the device does not comply with a policy, during device synchronization with the Administration Server, Kaspersky Endpoint Security for Android writes an entry for Violation detected: <name of the criterion checked> in the event log. You can view the Event log on the Events tab in the Administration Server properties or in the local properties of the application.

6. To notify the device user that the user's device does not comply with the policy, in the Non-compliance notifications section select the Notify user check box.

   If the device does not comply with a policy, during device synchronization with the Administration Server, Kaspersky Endpoint Security for Android notifies the user about this.

7. In the Compliance Control rules section, compile a list of rules for checking the device for compliance with the policy.
8. To add a rule, click Add.

   The Compliance Rule Wizard starts. Proceed through the wizard by using the Next button.

9. Select a non-compliance criterion for the rule.

   The following criteria are available:

   • Real-time protection is disabled

     Checks whether the security app is not installed on the device or is not running.

   • Anti-malware databases are out of date

     Checks whether the anti-malware databases were last updated 3 or more days ago.

   • Forbidden apps are installed

     Checks whether the list of apps on the device contains apps that are set as forbidden in the App Control.

   • Apps from forbidden categories are installed

     Checks whether the list of apps on the device contains apps from the categories that are set as forbidden in the App Control.

   • Not all required apps are installed

     Checks whether the list of apps on the device does not contains an app that is set as required in the App Control.

   • Operating system version is out of date

     Checks whether the Android version on the device is within the allowed range.

     For this criterion, specify the minimum and maximum allowed versions of Android. If the maximum allowed version is set to Any, it means that future Android versions supported by Kaspersky Endpoint Security for Android will also be allowed.

   • Device has not been synchronized for a long time

     Checks how long ago the device last synchronized with Administration Server.

     For this criterion, specify the maximum period after the last sync.

   • Device has been rooted

     Checks whether the device is hacked (whether root access is gained on the device).

   • Unlock password is not compliant with security requirements

     Checks whether the unlock password on the device does not comply with the settings defined in the Device Management section of the policy.

   • Installed version of Kaspersky Endpoint Security for Android is not supported

     Checks whether the security application installed on the device is not obsolete.

     This criterion applies only to an app installed using a Kaspersky Endpoint Security for Android installation package and if the latest version is specified in the Upgrade of Kaspersky Endpoint Security for Android section of Additional properties of the policy.

     For this criterion, you also need to specify the minimum allowed version of Kaspersky Endpoint Security for Android.

   • SIM card usage is not compliant with security requirements

     Checks whether the device SIM card has been replaced or removed compared to the previous check state.

     You can also enable the check for an additional SIM card.

     In some cases, replacement, removal, and insertion of an eSIM is also checked.

   • Device is within or outside the geofence areas

     Specifying the geofence area will result in increased device power consumption.

     For this criterion, select the specific requirement that must be monitored:

     • The device is within any of the geofence areas in the list (the geofence areas are combined using the OR logical operator).
     • The device is outside all of the geofence areas in the list (the geofence areas are combined using the AND logical operator).

     In the List of geofence areas block, you can add, edit, or delete geofence areas.

     To add a new geofence area:

     1. Click the Add button.

        Opens the Add geofence area window.

     2. Specify the Geofence area name.
     3. In the Coordinates of the geofence area perimeter section, specify a latitude and a longitude for each point.

        If you want to add more than 3 points, click the Add point button. To delete a point, click the X button.

        For each geofence area, you can manually enter from 3 to 100 coordinate pairs (latitude, longitude) as decimal numbers.

        A geofence area perimeter must not contain intersecting lines.

     4. You can view the specified geofence area in the Yandex.Maps program, by clicking the View on map button.
     5. Click the Add button to add the specified geofence area.

        The new geofence area appears in the list.

     To edit a geofence area:

     1. Select the geofence area you want to edit, and then click the Edit button.
     2. Specify the new geofence area settings, as described earlier.
     3. Click the Add button.

        The edited geofence area appears in the list.

     To delete a geofence area:

     1. Select the geofence area you want to delete, and then click the Delete button.

        The geofence area is removed from the list.

   • Kaspersky Endpoint Security for Android has no access to precise or background location

     Checks whether the Kaspersky Endpoint Security for Android app is not allowed to access the precise location of the device or use the device location in the background.

10. Select the actions to be performed on the device if the specified non-compliance criterion is detected. You can add multiple actions. They are combined by the AND logical operator.

    Some of the actions are continuous. Continuous actions remain in effect until one of the following conditions are met:

    • The non-compliance criterion no longer applies.
    • A policy is applied in which the corresponding Compliance Control rule is deleted.

    The following actions are available:

    • Block all apps except system apps

      All apps on the user's mobile device, except system apps, are blocked from starting.

      As soon as the non-compliance criterion selected for the rule is no longer detected on the device, the apps are automatically unblocked.

    • Lock device

      The mobile device is locked. To obtain access to data, you must unlock the device. If the reason for locking the device is not rectified after the device is unlocked, the device will be locked again after the specified time period.

    • Wipe corporate data

      The corporate data is wiped from the device. The list of wiped data depends on the mode in which the device operates:

      • On a personal device, KNOX container and mail certificate are wiped.
      • If the device operates in device owner mode, KNOX container and the certificates installed by Kaspersky Endpoint Security for Android (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
      • Additionally, if Android work profile is created, the work profile (its content, configurations, and restrictions) and the certificates installed in the work profile (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
    • Full reset

      All data is deleted from the mobile device and the settings are rolled back to their factory values. After this action is completed, the device will no longer be a managed device. To connect the device to Kaspersky Security Center, you must reinstall Kaspersky Endpoint Security for Android.

      On devices running Android 14 or later, this response is only applicable if the device is operating in device owner mode.

    • Lock work profile

      The work profile on the device is locked. To obtain access to the work profile, you must unlock it. If the reason for locking the work profile is not rectified after it is unlocked, the work profile will be locked again after the specified time period.

      The action is only applicable to Android 6 or later.

      After the work profile on a device is locked, the history of work profile passwords is cleared. It means that the user can specify one of the recent passwords, regardless of the work profile password settings.

    • Wipe data of all apps

      The action is only applicable to devices running Android 9 or later in device owner mode or with created Android work profile.

      If the device works in device owner mode, data of all apps on the device is wiped. If Android work profile is created on the device, data of all apps in the work profile is wiped.

      As a result, apps are rolled back to their default state.

    • Wipe data for a specified app

      The action is only applicable to devices running Android 9 or later in device owner mode or with created Android work profile.

      For this action, you need to specify the package name for the app whose data is to be deleted. How to get the package name of an app

      To get the package name of an app:

      1. Open Google Play.
      2. Find the required app and open its page.

      The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

      To get the package name of an app that has been added to Kaspersky Security Center:

      1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
      2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

      In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

      If you have an app package as an APK file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

      As a result, the app is rolled back to its default state.

    • Prohibit safe boot

      The user is not allowed to boot the device in safe mode.

      The action is only applicable to devices running Android 6 or later in device owner mode.

      This is a continuous action.

    • Prohibit use of camera

      The user is not allowed to use any cameras on the device.

      This is a continuous action.

    • Prohibit use of Bluetooth

      The device user is not allowed to turn on and configure Bluetooth in Settings.

      The action is only applicable to personal devices running Android 12 or earlier, devices operating in device owner mode, or devices with created Android work profile.

      This is a continuous action.

    • Prohibit use of Wi-Fi

      The device user is not allowed to use Wi-Fi and configure it in Settings.

      The action is only applicable to devices operating in device owner mode (all Android versions), personal devices running Android 9 or earlier.

      This is a continuous action.

    • Prohibit USB debugging features

      The user is not allowed to use USB debugging features and developer mode on the device.

      The action is only applicable to devices operating in device owner mode or devices with created Android work profile.

      This is a continuous action.

    • Prohibit airplane mode

      The user is not allowed to enable airplane mode on the device.

      The action is only applicable to devices running Android 9 or later in device owner mode.

      This is a continuous action.

      The new rule appears in the Compliance Control rules section.

11. To temporarily disable a rule that you have created, use the toggle switch opposite the selected rule.
12. In the Actions when user accounts are disabled in Active Directory section, you can configure the actions to perform on devices when a user account is disabled in Active Directory.

    These parameters require integration with Microsoft Active Directory.

    To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and choose one of the following actions:

    • Wipe corporate data
    • Reset to factory settings

      On devices running Android 14 or later, this action is only applicable if the device is operating in device owner mode.

13. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. If the user device does not comply with the rules, the restrictions you have specified in the scan rule list are applied to the device.

Compliance control of iOS MDM devices with corporate security requirements

Expand all | Collapse all

Compliance Control allows you to monitor iOS MDM devices for compliance with corporate security requirements and take actions if non-compliance is found. Compliance Control is based on a list of rules. Each rule includes the following components:

• Status (whether the rule is enabled or disabled).
• Non-compliance criteria (for example, absence of the specified apps or operating system version).
• Actions performed on the device if non-compliance is found (for example, wipe corporate data or send an email message to the user).

To create a rule:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Compliance Control section.
5. In the Compliance Control rules section, click Add.

   The Compliance Control Rule Wizard starts.

6. Select the Enable rule check box if you want to activate the rule. If the check box is cleared, the rule is disabled.
7. On the Non-compliance criteria tab, click Add criterion and select a non-compliance criterion for the rule. You can add multiple criteria. They are combined by the AND logical operator.

   The following criteria are available:

   • List of apps on device

     Checks whether the list of apps on the device contains forbidden apps or does not contain required apps.

     For this criterion, you need to select a check type (Contains or Does not contain) and specify the app's bundle ID. How to get the bundle ID of an app

     To get the bundle ID of a native iPhone or iPad app,

     Follow the instruction in Apple documentation.

     To get the bundle ID of any iPhone or iPad app:

     1. Open App Store.
     2. Find the required app and open its page.

        The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

     3. Copy this identifier (without letters "id").
     4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

        This downloads a text file.

     5. Open the downloaded file and find there the "bundleId" fragment.

     The text that directly follows this fragment is the bundle ID of the required app.

     To get the bundle ID of an app that has been added to Kaspersky Security Center:

     1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
     2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

     In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

     If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

   • Operating system version

     Checks the version of the operating system on the device.

     For this criterion, you need to select a comparison operator (Equal to, Not equal to, Less than, Less than or equal to, Greater than, or Greater than or equal to) and specify the iOS version.

     Note that the Equal to and Not equal to operators check for a full match of the operating system version with the specified value. For instance, if you specify 15 in the rule, but the device is running iOS 15.2, the Equal to criterion is not met. If you need to specify a range of versions, you can create two criteria and use the Less than and Greater than operators.

   • Management mode

     Checks the device's management mode.

     For this criterion, you need to select a mode (Supervised device or Non-supervised device).

   • Device type

     Checks the device type.

     For this criterion, you need to select a type (iPhone or iPad).

   • Device model

     Checks the device model.

     For this criterion, you need to select an operator (Included in the list or Not included in the list), and then specify models that will be checked or excluded from the check, respectively.

     To specify a model, type at least one character in the Identifier field, and then select the required model from the appeared list. The list contains mobile device codes and their matching product names. For example, if you want to add all iPhone 14 models, type "iPhone 14". In this case, you can select any of the available models: "iPhone 14", "iPhone 14 Plus", "iPhone 14 Pro", "iPhone 14 Pro Max".

     In some cases, the same product name may correspond to several mobile device codes (for example, the "iPhone 7" product name corresponds to two mobile device codes, "iPhone 9.1" and "iPhone 9.3"). Be sure that you select all of the mobile device codes that correspond to the required models.

     If you type a value that is not on the list, nothing will be found. However, you can click the OK button in the field to add the typed value to the criterion.

   • Device is roaming

     Checks whether the device is roaming (if you select True) or not (if you select False).

   • Device password was set

     Checks whether a password is set (if you select True) or not (if you select False).

     If you select True, select whether the device password must match (if you select Matches policy) or must not match (if you select Does not match policy) the settings specified in the Password Settings section.

   • Device free space

     Checks whether the amount of free space on the device becomes less than the threshold that you specify.

     For this criterion, specify the threshold amount of free space, and then select the measurement unit (GB or MB).

   • Device is not encrypted

     Checks whether the device is not encrypted.

     Data encryption is enabled by default on password-locked iOS devices (Settings > Touch ID / Face ID and Password > Enable Password). Also, the hardware encryption on a device must be set to At block and file level (you can check this parameter in the device properties: in the console tree, select Mobile Device Management > Mobile devices, and then double-click the required device).

   • SIM card has been changed

     Checks whether the device SIM card has been replaced or removed compared to the previous check state.

     You can also enable the check for inserting an additional SIM card.

     On eSIM compatible devices, the non-compliance detection cannot be removed by inserting the previously removed eSIM. This is because the device's operating system recognizes each added eSIM as a new one. In this case, you need to delete the compliance control rule from the policy.

   • Last sync earlier than

     Checks how long ago the device last synchronized with Administration Server.

     For this criterion, specify the maximum time after the last sync, and then select the measurement unit (Hours or Days).

     We do not recommend that you specify a value less than the value of the Updating frequency for information about devices parameter in the iOS MDM Server settings.

   If you specify criteria that contradict each other (for example, Device type is set to iPhone but the list of values of Device model, with the Included in the list operator selected, contains an iPad model), an error message is displayed. You cannot save such a rule.

8. On the Actions tab, specify actions to be performed on the device if all specified non-compliance criteria are detected.

   Actions are performed during the compliance rule check, which happens every 40 minutes, and persist until the next synchronization with the Administration Server. To prevent repeat actions from a single instance of non-compliance, set the Updating frequency for information about devices parameter in the iOS MDM Server settings to 30 minutes.

   Add an action in one of the following ways:

   • Click the Add action button if the action should be taken on the device immediately after non-compliance is detected.
   • Click the Add postponed action button if you want to also set a time period in which the user can fix the non-compliance. If the non-compliance is not fixed within this period, the action is performed on the device.

   The following actions are available:

   • Send email message to user

     The device user is informed about the non-compliance by email.

     For this action, you need to specify the user's email address(es). If necessary, you can edit the default text of the email message.

   • Wipe corporate data

     All installed configuration profiles, provisioning profiles, the iOS MDM profile, and applications for which the Remove together with iOS MDM profile check box has been selected are removed from the device. This action is performed by sending the Wipe corporate data command.

   • Install profile

     The configuration profile is installed on the device. This action is performed by sending the Install profile command.

     For this action, you need to specify the ID of the configuration profile to be installed.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete profile

     The configuration profile is deleted from the device. This action is performed by sending the Remove profile command.

     For this action, you need to specify the ID of the configuration profile to be removed.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete all profiles

     All previously installed configuration profiles are deleted from the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted configuration profiles one by one, by sending the respective command to the device.

   • Update operating system

     The device operating system is updated.

     For this action, you need to select the specific operation (Download and install, Download only, or Install only if you want to install a previously downloaded version) and the iOS version to be downloaded and/or installed.

   • Change Bluetooth settings (supervised only)

     For this action, you need to select whether you want to enable or disable Bluetooth on the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Reset to factory settings

     All data is deleted from the device and the settings are rolled back to their default values.

   • Delete managed app

     For this action, you need to specify the bundle ID of the managed app that you want to delete from the device. An app is considered managed if it has been installed on a device through Kaspersky Security Center. How to get the bundle ID of an app

     To get the bundle ID of a native iPhone or iPad app,

     Follow the instruction in Apple documentation.

     To get the bundle ID of any iPhone or iPad app:

     1. Open App Store.
     2. Find the required app and open its page.

        The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

     3. Copy this identifier (without letters "id").
     4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

        This downloads a text file.

     5. Open the downloaded file and find there the "bundleId" fragment.

     The text that directly follows this fragment is the bundle ID of the required app.

     To get the bundle ID of an app that has been added to Kaspersky Security Center:

     1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
     2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

     In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

     If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   • Delete all managed apps

     All managed apps are deleted from the device. An app is considered managed if it has been installed on a device through Kaspersky Security Center.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted apps one by one, by sending the respective command to the device.

   • Delete profile(s) of a specific type

     For this action, you need to select the type of the profile to be deleted from the device (for example, Web Clips or Calendar subscriptions).

     As soon as the non-compliance criteria selected for the rule are no longer detected on the device, the deleted profiles are automatically restored.

   • Change roaming settings

     For this action, you need to select whether you want to enable or disable data roaming on the device.

     When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the action by sending the respective command to the device.

   If you specify actions that contradict each other (for example, Enable Bluetooth and Disable Bluetooth at the same time, an error message is displayed. You cannot save such a rule.

9. Click the OK button to save the rule and close the wizard.

   The new rule appears in the list in the Compliance Control rules section.

10. In the Actions when user accounts are disabled in Active Directory section, you can configure the actions to perform on devices when a user account is disabled in Active Directory.

    These parameters require integration with Microsoft Active Directory.

    To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and choose one of the following actions:

    • Wipe corporate data
    • Reset to factory settings

    If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.

11. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

App control

This section contains instructions on how to configure user access to apps on a mobile device.

App control on Android devices

The App Control component allows you to manage apps on Android devices to keep these devices secure.

You can impose restrictions on the user's activity on a device on which blocked apps are installed or required apps are not installed (for example, lock the device). You can impose restrictions using the Compliance Control component. To do so, in the scan rule settings, you must select the Forbidden apps are installed, Apps from forbidden categories are installed, or Not all required apps are installed criterion.

Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure proper functioning of App Control. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time. If this is the case, App Control does not run.

In device owner mode, you have extended control over the device. App Control operates without notifying the device user:

• Required apps are installed automatically in the background. To install apps silently, you need to specify a link to the APK file of the required app in the policy settings.
• Forbidden apps can be deleted from the device automatically. To delete apps silently, you need to select the Delete blocked apps automatically (in device owner mode only) check box in the policy settings.

To configure the settings of app startup on the mobile device:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App Control section.
5. In the Operation mode section, select the mode of app startup on the user's mobile device:
   • To allow the user to start all apps except those specified in the list of categories and apps as blocked apps, select the Forbidden apps mode. The app will hide blocked app icons.
   • To allow the user to start only apps specified in the list of categories and apps as allowed, recommended, or required apps, select the Allowed apps mode. The app will hide all app icons except those specified in the list of allowed, recommended, or required apps and system apps.
6. If you want Kaspersky Endpoint Security for Android to send data on forbidden apps to the event log without blocking them, select the Do not block forbidden apps, only add a record to the event log check box.

   During the next synchronization of the user's mobile device with the Administration Server, Kaspersky Endpoint Security for Android writes an entry for A forbidden app has been installed in the event log. You can view the Event log on the Events tab in the Administration Server properties or in the local properties of the application.

7. If the device is in device owner mode, select the Delete blocked apps automatically (in device owner mode only) check box to remove forbidden apps from the device in the background without notifying the user.
8. If you want Kaspersky Endpoint Security for Android to block the startup of system apps on the user's mobile device (such as Calendar, Camera, and Settings) in Allowed apps mode, select the Block system apps check box.

   Kaspersky experts recommend against blocking system apps because this could lead to failures in device operation.

   Before removing Kaspersky Endpoint Security for Android from the device, clear this check box or disable App Control.

9. Create a list of categories and apps to configure startup of apps.

   Mobile app packages previously created in the Kaspersky Security Center can be added to the list. How to get the package name of an app

   To get the package name of an app:

   1. Open Google Play.
   2. Find the required app and open its page.

   The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

   To get the package name of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an APK file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

   For details on app categories, please refer to the Appendices.

   For a list of the apps that belong to each category, please visit the Kaspersky website.

10. If you want Kaspersky Endpoint Security for Android to create a report on installed apps, in the Report on installed mobile apps block, select the Send data on installed apps check box to send information about apps installed on mobile devices, and specify the following settings if required:
    • To send data about the system apps installed on users' devices to the Administration Server, select the Send data on system apps check box.
    • To send data about the service apps installed on users' devices to the Administration Server, select the Send data on service apps check box.

    If a system app or a service app is configured in the App Control settings, the app data is sent regardless of the state of the Send data on system apps or the Send data on service apps check boxes respectively.

    Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed to a device or removed from it.

11. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

App control on iOS MDM devices

Expand all | Collapse all

Kaspersky Security Center allows you to manage apps on iOS MDM devices to keep these devices secure. You can create a list of apps allowed to be installed on devices and a list of apps prohibited from being displayed and launching on devices.

These restrictions apply only to supervised iOS MDM devices.

Open Restrictions for applications section

To open settings for app restrictions on iOS MDM devices:

1. In the console tree, in the Managed devices folder, select the administration group to which the iOS MDM devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Restrictions for Applications section.

Restrict app installation

By default, the user can install any apps on the supervised iOS MDM device.

To restrict the apps that can be installed on the device:

1. Select the Allow installation of apps from the list (supervised only) check box.
2. In the table, click Add to add an app to the list.
3. Specify the app's bundle ID. Specify the com.apple.webapp value to allow all web clips. How to get the bundle ID of an app

   To get the bundle ID of a native iPhone or iPad app,

   Follow the instruction in Apple documentation.

   To get the bundle ID of any iPhone or iPad app:

   1. Open App Store.
   2. Find the required app and open its page.

      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

   3. Copy this identifier (without letters "id").
   4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

      This downloads a text file.

   5. Open the downloaded file and find there the "bundleId" fragment.

   The text that directly follows this fragment is the bundle ID of the required app.

   To get the bundle ID of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

4. Click the Apply button to save the changes you have made.

Once the policy is applied to a device, the specified restrictions for apps are configured on the device. Only apps from the list and system apps will be available for installation. All other apps cannot be installed on the device.

The specified apps can be installed on the device in the following ways (if the corresponding options are enabled in the Features restrictions section):

• Installation from Apple Configurator or iTunes
• Installation from App Store
• Automatic loading

Specify prohibited apps

By default, all apps can be displayed and launched on the supervised iOS MDM device.

To specify prohibited apps:

1. Select the Prohibit displaying and launching apps from the list (supervised only) check box.
2. In the table, click Add to add an app to the list.
3. Specify the app's bundle ID. Specify the com.apple.webapp value to restrict all web clips. How to get the bundle ID of an app

   To get the bundle ID of a native iPhone or iPad app,

   Follow the instruction in Apple documentation.

   To get the bundle ID of any iPhone or iPad app:

   1. Open App Store.
   2. Find the required app and open its page.

      The app's URL ends with its numerical identifier (for example, https://apps.apple.com/us/app/google-chrome/id535886823).

   3. Copy this identifier (without letters "id").
   4. Open the web page https://itunes.apple.com/lookup?id=<copied identifier>.

      This downloads a text file.

   5. Open the downloaded file and find there the "bundleId" fragment.

   The text that directly follows this fragment is the bundle ID of the required app.

   To get the bundle ID of an app that has been added to Kaspersky Security Center:

   1. In the console tree of Kaspersky Security Center go to Advanced > Remote installation > Installation packages.
   2. Click the Additional actions button and select Manage mobile apps packages in the drop-down list.

   In the Mobile apps package management window that opens, identifiers of managed apps are displayed in the Application name column.

   If you have an app package as an .apk or .ipa file and want to know the app identifier, you can add the app package to the Mobile apps package management window by clicking the New button and following the on-screen instructions.

4. Click the Apply button to save the changes you have made.

Once the policy is applied to a device, the specified restrictions for apps are configured on the device. Apps from the list will be prohibited from being displayed and launching on the device. All other apps will be displayed and available to run.

Statuses of mobile devices

Mobile device statuses defined by Kaspersky Security Center

Administration Console allows you to quickly assess the current status of Kaspersky Security Center and managed mobile devices by checking traffic lights. The traffic lights are shown in the workspace of the Administration Server node, in the Mobile Device Management folder, in the Mobile devices subfolder. The subfolder workspace displays a table of managed mobile devices.

A traffic light is a colored icon in the Management column of the table. Each traffic light can be any of these colors (see the table Color codes of traffic lights). The color of a traffic light depends on the current status of Kaspersky Security Center and on the events that were logged.

A device can have one of the following statuses: OK, Critical, or Warning.

The statuses are assigned and sent to Kaspersky Security Center, in accordance with the following requirements:

• One reason for status assignment is detected on the device — the device gets the status which is displayed in the list of managed devices.
• Several reasons for status assignment are detected on the device — Kaspersky Secure Mobility Management selects the most critical status and sets it as general.
• No reasons for status assignment are detected on the device — Kaspersky Secure Mobility Management does not send the structure of statuses to Kaspersky Security Center, and the status is set as OK.

  Color codes of traffic lights

  Icon	Status	Traffic light color meaning
  	Light blue Mobile device detected on the network and included in none of the administration groups.	Events have been logged that are unrelated to potential or actual threats to the security of managed devices.
  	Green Mobile device included in an administration group, with the OK status.	An administrator's intervention is not required.
  	Yellow Mobile device included in an administration group, with the Warning status.	Events have been logged that are related to potential or actual threats to the security of managed devices.
  	Red Mobile device included in an administration group, with the Critical status.	Serious problems have been encountered. An administrator's intervention is required to solve them.
  	Mobile device included in an administration group, having lost its connection with the Administration Server.	Can be any of the colors: light blue, green, yellow, red.

The administrator's goal is to keep traffic lights green on all of the devices.

You can select Properties from the context menu of the mobile device, and then go to the Protection section to view the logged events that affect traffic lights and the status of Kaspersky Security Center (see the table Name, description, and traffic light colors of logged events).

Name, description, and traffic light colors of logged events

Mobile device statuses defined by Kaspersky Secure Mobility Management

These are additional statuses that function together with the statuses defined by Kaspersky Security Center (see the table Name, description, and traffic light colors of logged events).

Kaspersky Secure Mobility Management defines the status of mobile devices, based on the policy settings, and then sends the structure of statuses to Kaspersky Security Center when it is synchronized. The administrator can change the device status in the policy, depending on the severity level of the condition (see the table Default values, reasons, and conditions for status assignment). In this case, the value set by the administrator overrides the default value defined by Kaspersky Secure Mobility Management.

Default values, reasons, and conditions for status assignment

Software inventory on Android devices

You can inventory apps on Android devices connected to Kaspersky Security Center. Kaspersky Endpoint Security for Android receives information about all apps installed on mobile devices. Information acquired during inventory is displayed in the device properties in the Events section. You can view detailed information on each installed app, including its version and publisher.

To enable software inventory:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the App Control section.
5. In the Report on installed mobile apps section, select the Send data on installed apps check box.
6. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed or removed from the device.

Configuring the display of Android devices in Kaspersky Security Center

For convenient operations with the list of mobile devices, you should configure the settings for displaying devices in Kaspersky Security Center. By default, the list of mobile devices is displayed in the Additional → Mobile Device Management → Mobile devices console tree. Device information is updated automatically. You can also manually update the list of mobile devices by clicking the Update button in the upper right corner.

After connecting the device to Kaspersky Security Center, devices are added to the mobile device list automatically. The mobile device list may contain detailed information about that device: model, operation system, IP address, and others.

You can configure the device name format and select the device status. The device status informs you about how the components of Kaspersky Endpoint Security for Android are operating on the user's mobile device.

Kaspersky Endpoint Security for Android components could be non-operational for the following reasons:

• The user disabled the component in the device settings.
• The user did not grant the app the necessary permissions for the component to operate (for example, there is no permission to determine the device location for the corresponding Anti-Theft command).

To display the device status, you must enable the Determined by the application condition in the administration group properties (Properties > Device status > Set device status to Critical if and Set device status to Warning if). In the administration group properties, you can also select other criteria for forming the mobile device status.

To configure the display of Android devices in Kaspersky Security Center:

1. In the console tree, in the Managed devices folder, select the administration group to which the Android devices belong.
2. In the workspace of the group, select the Policies tab.
3. Open the policy properties window by double-clicking any column.

   Complete the following steps within 15 minutes. Otherwise, you may face an error when saving changes to the policy.

4. In the policy Properties window, select the Device information section.
5. In the Device name in Kaspersky Security Center section, select the device name format for the device name in the Administration Console:
   • Device model [email, device ID]
   • Device model [email (if any) or device ID]

   A device ID is a unique ID that Kaspersky Endpoint Security for Android generates from the data received from a device as follows:

   • On personal devices running Android 9 and earlier, the app uses the IMEI. For later versions of Android, the app uses SSAID (Android ID) or checksum of other data received from the device.
   • In device owner mode, the app uses IMEI on all Android versions.
   • When a work profile is created on devices running Android 11 or earlier, the app uses IMEI. On other Android versions, the app uses the SSAID (Android ID) or checksum of other data received from the device.
6. Set the Lock attribute in the locked position ().
7. In the Device status in Kaspersky Security Center section, select the appropriate device status if a component of Kaspersky Endpoint Security for Android is not working: (Critical), (Warning) or (OK).

   In the list of mobile devices, the device status will be changed according to the selected status.

8. Set the Lock attribute in the locked position.
9. Click the Apply button to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.