Managing the app by using third-party EMM systems (Android only)

You can use the Kaspersky Endpoint Security for Android app without Kaspersky Administration Systems. Use solutions of other EMM (Enterprise Mobility Management) service providers to deploy and manage the Kaspersky Endpoint Security for Android app. Kaspersky participates in the AppConfig Community to ensure that the app operates with third-party EMM solutions.

You can manage the Kaspersky Endpoint Security for Android app through third-party EMM solutions only on devices running Android.

If you want to use a third-party EMM solution only to deploy the Kaspersky Endpoint Security for Android app, then you can manage devices in the Web Console after deployment.

You cannot use the Web Console and a third-party EMM solution simultaneously to manage devices.

If you deployed the Kaspersky Endpoint Security for Android app using the third-party EMM system, it is impossible to manage the app in Kaspersky Endpoint Security Cloud. You can manage the Kaspersky Endpoint Security for Android app in the EMM Console.

The following EMM solutions support the use of the Kaspersky Endpoint Security for Android app:

• VMware AirWatch
• MobileIron
• IBM Maas360
• Microsoft Intune
• SOTI MobiControl

You can perform the following actions in the EMM Console:

• Deploy the app to an Android work profile on users' devices.
• Activate the app.
• Configure app settings:
  • Enable protection against malicious and phishing websites on the internet.
  • Configure settings for connecting the device to Kaspersky Security Center.
  • Configure Anti-Malware settings.
  • Configure the schedule for running a malware scan on the device.
  • Enable detection of adware and apps that could be exploited by criminals to harm the user's device or personal data.
  • Configure the schedule for app database updates.

Getting Started

Kaspersky Endpoint Security for Android is currently not available in Google Play.

To deploy the app on users' mobile devices, you must add Kaspersky Endpoint Security for Android to the EMM app store. For more details about working with apps in the EMM Console, visit the technical support website of the EMM service provider.

The Kaspersky Endpoint Security for Android app is deployed in an Android work profile. The app is isolated from the user's personal data and protects only corporate data in the work profile. It is recommended to ensure that Kaspersky Endpoint Security for Android is protected from removal by EMM Console tools.

How to install the app

If you want to manage devices in a third-party EMM console, you can distribute the app using the APK file from the Kaspersky website.

The following permissions are required for the app to work:

• Storage permission for accessing files when Anti-Malware is running (only for Android 6 or later).
• Phone permission for identifying the device, for example, when activating the app.
• Request to add Kaspersky Endpoint Security for Android to the list of apps that are started at operating system startup (on certain devices, such as HUAWEI, Meizu, and Xiaomi). If the add request is not displayed, manually add Kaspersky Endpoint Security for Android to the list of startup apps. The request may not be displayed if the Security app is not installed in the work profile.

You can grant the required permissions in the EMM Console before deploying the Kaspersky Endpoint Security for Android app. For more details about granting the permissions in the EMM Console, visit the technical support website of the EMM service provider. You can also grant the permissions while completing the Initial Configuration Wizard of Kaspersky Endpoint Security for Android on device.

The Kaspersky Endpoint Security for Android app will be installed in the Android work profile.

For operation of Web Protection, you must also configure a proxy server in Google Chrome settings using the AppConfig file of a third-party EMM system:

• Proxy server configuration mode: manual.
• Proxy server address and port: 127.0.0.1:3128.
• SPDY protocol support: disabled.
• Data compression through proxy server: disabled.

Protecting devices on the internet

To protect the personal data of a mobile device user on the internet, enable Web Protection. Web Protection blocks malicious websites that distribute malicious code, and phishing websites designed to steal your confidential data and gain access to your financial accounts. Web Protection scans websites before you open them using the Kaspersky Security Network cloud service.

For the Web Protection component to work, the following conditions must be met:

• The proxy server is configured in the browser settings:

  ProxyMode = "fixed_servers"

  ProxyServer = "127.0.0.1:3128"

  DisableSpdy = true

  DataCompressionProxyEnabled = false

  Proxy server configuration may vary depending on the Google Chrome version. For more details about configuring Google Chrome, visit the Chromium project website.

  After the Kaspersky Endpoint Security for Android app is removed from the mobile device, reset the proxy server settings.

• Device users accept the Privacy Policy and the Web Protection Statement in the Initial Configuration Wizard or app settings.

  Administrator can accept the Web Protection Statement in the Kaspersky Security Center Web Console.

• Web Protection is enabled in the app settings:
  EnableWebFilter = True, EnableWebFilterLock = True.
• Use of KSN is enabled in the app settings: UseKsnMode = Recommended or UseKsnMode = Extended.

To configure Google Chrome proxy server via the VMware Workspace ONE Console:

1. In the console, select Apps & Books → Application → Native.

   App catalog opens.

2. Select the Public section.
3. Select the Google Chrome app.

   App properties window opens.

4. Select the Assignment section.
5. In the window that opens, click the Assign button.

   The list of devices that the app is assigned opens.

6. Click the Edit button.
7. In the window that opens, click Configure.

   The app configuration opens. You can read about each of the app parameters using tool tip.

8. Specify the necessary settings:
   • Proxy Mode – Use fixed proxy server.
   • Proxy Server URL – 127.0.0.1:3128.
   • SPDY protocol support – disabled.
   • Data compression through proxy server – disabled.
9. Save changes.

To enable Web Protection in Google Chrome via the VMware Workspace ONE Console:

1. In the console, select Apps & Books → Application → Native.

   App catalog opens.

2. Select the Public section.
3. Select the Kaspersky Endpoint Security app.

   App properties window opens.

4. Select the Assignment section.
5. In the window that opens, click the Assign button.

   The list of devices that the app is assigned opens.

6. Click the Edit button.
7. In the window that opens, click Configure.

   The app configuration opens. You can read about each of the app parameters using tool tip.

8. Specify the necessary settings:
   • Web Protection – Enable.
   • Forbid configuration of Web Protection settings – Enable. The user cannot access Web Protection settings within the app settings.
   • Kaspersky Security Network mode – Recommended or Extended.

     Recommended – The app exchanges data with Kaspersky Security Network (KSN). Kaspersky Endpoint Security for Android uses KSN for real-time protection of the device against threats (Cloud Protection) and the operation of Web Protection on the internet.

     Extended – The app exchanges data with Kaspersky Security Network and also sends the Virus Laboratory certain performance statistics from Kaspersky Endpoint Security for Android. This information makes it possible to keep track of threats in real time. No personal data is collected, processed, or stored by KSN services.

9. Save changes.

If users' devices are connected to the Kaspersky Security Center, enable Web Protection in the group policy. Also, you can accept the Web Protection Statement in the Kaspersky Security Center Web Console.

After enabling Web Protection in the Kaspersky Endpoint Security for Android app and configuring Google Chrome, check protection against web threats. To check protection, you can use EICAR test.

How to activate the app

Information about the license is transmitted to the mobile device together with the other settings in the configuration file.

If the app is not activated within 30 days after its installation on the mobile device, the trial license expires. When the trial license expires, all features of the Kaspersky Endpoint Security for Android mobile app are disabled.

When the commercial license expires, the mobile app continues running with limited functionality (for example, Kaspersky Endpoint Security for Android database updates are not available). To continue using the app in fully functional mode, you must renew your commercial license.

To activate Kaspersky Endpoint Security for Android:

1. In the EMM Console, open the settings of the Kaspersky Endpoint Security for Android app.
2. In the LicenseActivationCode field, enter the app activation code.

   To activate the app on a device, you must have access to Kaspersky activation servers.

How to connect a device to Kaspersky Security Center

After Kaspersky Endpoint Security for Android is installed on a mobile device, you can connect the device to Kaspersky Security Center. The data necessary for connecting the device to Kaspersky Security Center is transmitted to the mobile device together with the other settings listed in the configuration file. After connecting the device to Kaspersky Security Center, you can use group policies to centrally configure the app settings. You can also receive reports and statistics on the performance of Kaspersky Endpoint Security for Android.

Prior to connecting devices to Kaspersky Security Center, make sure that the following conditions are fulfilled:

• The Kaspersky Endpoint Security for Android Administration Plug-in is installed on the administrator's workstation.
• The port for connecting mobile devices is opened in the Administration Server properties.
• The display of the Mobile Device Management folder is enabled in the Administration Console.
• A mobile certificate for identifying the mobile device user has been created in the Kaspersky Security Center certificate storage.

Prior to connecting devices to Kaspersky Security Center, it is recommended to do the following:

• If you want to create tasks and policies for mobile devices, create a separate administration group for mobile devices.
• If you want to automatically move mobile devices to a separate administration group, create a rule for automatically moving devices from the Unassigned devices folder.
• If you want to centrally configure Kaspersky Endpoint Security for Android, create a group policy.

To connect a device to Kaspersky Security Center:

1. In the EMM Console, open the settings of the Kaspersky Endpoint Security for Android app.
2. In the KscServer field, enter the DNS name or IP address of the Kaspersky Security Center Administration Server. The default port is 13292.
3. If you do not want the user to be distracted by Kaspersky Endpoint Security for Android notifications, disable app notifications. To do so, set the DisableNotification = True setting.

   After connecting, the app shows all notifications. You can disable certain app notifications in the policy settings.

   Do not disable app notifications if you do not use Kaspersky Security Center. This could cause a user to not receive notifications about the license expiring. As a result, the app will stop performing its functions.

After the connection settings are configured, Kaspersky Endpoint Security for Android displays a notification prompting you to grant the following additional rights and permissions:

• Permission to use the Camera for Anti-Theft operation (Mugshot command).
• Permission to use Location for Anti-Theft operation (Locate device command).
• Device administrator rights (Android work profile owner) for operation of the following app functions:
  • Install security certificate.
  • Configure Wi-Fi.
  • Configure Exchange ActiveSync.
  • Restrict use of the camera, Bluetooth, and Wi-Fi.

  Due to the specific characteristics of an Android work profile (absence of the Accessibility service), the App Control and Anti-Theft features are unavailable in the app.

When the user grants the necessary rights and permissions, the device will be connected to Kaspersky Security Center. If a rule for automatically moving devices to an administration group has not been created, the device will be automatically added to the Unassigned devices folder. If a rule for automatically moving devices to an administration group has been created, the device will be automatically added to the defined group.

Kaspersky Endpoint Security provides the following devices name format:

• Device model [email, device ID]
• Device model [email (if any) or device ID]

A device ID is a unique ID that Kaspersky Endpoint Security for Android generates from the data received from a device as follows:

• On personal devices running Android 9 and earlier, the app uses the IMEI. For later versions of Android, the app uses SSAID (Android ID) or checksum of other data received from the device.
• In device owner mode, the app uses IMEI on all Android versions.
• When a work profile is created on devices running Android 11 or earlier, the app uses IMEI. On other Android versions, the app uses the SSAID (Android ID) or checksum of other data received from the device.

You can configure device name format in the group policy.

In SOTI MobiControl, you can use the %DEVICENAME% macro in the KscDeviceName field. This macro allows you automatically get the device name from the SOTI MobiControl console to Kaspersky Security Center.

You can also add a tag to the device name. This makes it easier to find and sort devices in Kaspersky Security Center. The tag is available only for VMware AirWatch.

To add the tag to the device name:

1. In the EMM Console, open the settings of the Kaspersky Endpoint Security for Android app.
2. In the KscDeviceNameTag field, select the values:
   • {DeviceSerialNumber} – Serial number of the device.
   • {DeviceUid} – Unique device identifier (UDID).
   • {DeviceAssetNumber} – Device asset number. This number is created internally from within your organization.

   We recommend using only these values. VMware AirWatch supports other values, but Kaspersky Endpoint Security cannot guarantee work these values.

You can add some values (for example, {DeviceSerialNumber} {DeviceUid}). The tag will be added to the device name in Kaspersky Security Center. A space separates the tag and the device name. For example, if the device name is Google Pixel 2 a10c6b75f7b31de9 22:7D:78:9E:C5:1E, then 22:7D:78:9E:C5:1E is UDID tag. If you use Kaspersky Security Center and VMwareAirWatch, the tag allows you to identify devices in both consoles. To match the device, select the same values for the device name (for example, the serial number of the device).

After the device is connected to Kaspersky Security Center, the app settings will be changed according to the group policy. Kaspersky Endpoint Security for Android ignores the app settings from the configuration file that was configured in the EMM Console. You can configure all sections of the policy except the following sections:

• Anti-Theft (Device lock)
• Device management (Screen lock)
• App Control (Block forbidden apps)
• Android work profile
• Manage Samsung Knox

Due to the method used to deploy a work profile, you cannot apply group policy settings from the Android work profile section. These settings can be applied only if the work profile was created using Kaspersky Security Center.

Silent mode of the app

An Android device user can disable all notifications from Kaspersky Endpoint Security for Android in the settings on the notification bar. If notifications are disabled, the user does not monitor the operation of the app and can ignore important information (for example, information about threats in real time). In this case, to find out the app operating status, the user must open Kaspersky Endpoint Security for Android.

If you do not want the mobile device user to be distracted by Kaspersky Endpoint Security for Android notifications, you can disable certain notifications.

The Kaspersky Endpoint Security uses the following tools to display the device protection status:

• Protection status notification. This notification is pinned to the notification bar. Protection status notification cannot be removed. The notification displays the device protection status (for example, ) and number of issues, if any. You can tap the device protection status and see the list issues in the app.
• App notifications. These notifications inform the device user about the application (for example, threat detection).
• Pop-up messages. Pop-up messages require action from the device user (for example, action to take when a threat is detected).

The silent mode settings are transmitted to the mobile device together with the other settings in the configuration file. Set True value for the DisableNotification parameter.

To enable silent mode of the app via the VMware Workspace ONE Console:

1. In the console, select Apps & Books → Application → Native.

   App catalog opens.

2. Select the Public section.
3. Select the Kaspersky Endpoint Security app.

   App properties window opens.

4. Select the Assignment section.
5. In the window that opens, click the Assign button.

   The list of devices that the app is assigned opens.

6. Click the Edit button.
7. In the window that opens, click Configure.

   The app configuration opens. You can read about each of the app parameters using tool tip.

8. In the Disable app notifications before connecting to Kaspersky Security Center.

   If you use Kaspersky Security Center, enable silent mode in the group policy too.

9. Save changes.

As a result, the app will only show the Protection status notification. Other notifications and pop-ups will be disabled.

AppConfig File

A configuration file is generated to configure the app in an EMM Console. The app settings in the configuration file are presented in the table below.

Configuration file settings