App Management and Device Security

These are the questions asked during Mobile Device Management Training

FAQs

How can we install apps in devices without user intervention? For installing apps without user intervention, we can make use of Apple Business Manager (ABM) for iOS devices and for Android devices, make use of Managed Google Play (PfW).
How can I restrict the devices to connect only to one Wifi network? For restricting the devices to only one Wifi network, go to "profiles"- Create a wifi profile, to which you want the devices to connect to. Under Network and roaming, enable "connect to wi-fi only if distributed via MDM"
Can we just manage the corporate applications without completely managing the users device? Yes, we can choose to manage only the corporate apps in the devices. For that we will have to logically containerize our devices into a corporate workspace and personal work space (The apps are containerized by default in Android devices.)
In Kiosk Mode, will you still be able to swipe and go to "Settings"? If the device is locked to a single app, by default settings cannot be accessed. Similarly, in the case of locking the device to multiple apps, for Android devices the settings cannot be accessed. In the case of iOS devices, settings will be available and we can restrict the user from making changes to the device settings.
How to ensure silent installation of enterprise apps? For silent installation of enterprise apps make sure-
The iOS devices are supervised.
The Android devices are provisioned as Device Owner.
The distribution option, "Force Install VPP/Enterprise Apps" is enabled.
How can we identify the profiles applied by the console to the devices? All information about the profiles that have been associated with the groups and devices is available in "Groups/Devices" under "Device Mgmt" tab.
If a device is locked and the data/ wi-fi settings are turned off, can the data be retrieved or the device will have to be factory reset? In the case of iOS devices, we can not retrieve the data, and the device will have to be factory reset.
In the case of Android devices, to retrieve the data, you will have to contact the MDM support team.
Is it possible to force all the network traffic through a proxy server? Yes, we can route all the network traffic through a proxy server by configuring the Global HTTP proxy. Follow the steps given here to configure it.
Does URL blocklisting only work for Safari or all the browsers? What happens in the case of Android devices? In iOS and Samsung devices, URL blocklisting works for all the browsers in the device, where as in the case of non-Samsung Android devices, it is available only for Chrome browser.
Is it possible to view the location history of devices or only the current location of the device can be obtained? Yes, this feature is available from Mobile Device Manager Plus build 92165
Is it possible to track the location of the devices only when they are lost and not at all times? Yes, it is possible to track the location of the lost devices only.Under "Geo-Tracking", select "When Lost" for "Track Devices" option. This will track the devices only when we enable Lost Mode on the device.
How can we ensure that the users do not disable location tracking on their devices? For Android devices, add a restriction in profiles, where the GPS is "always on". For iOS devices, the restrictions have to be enabled on the device before handing it over to the user.
Is it possible to prevent copying text from emails? For Android 5.0 and above devices, the "Clip Board" feature required to copy texts is by default disabled. This will ensure that the data cannot be copied. In the case of iOS devices, this feature is not supported by Apple. We can just prevent the attachment from being copied.
How can I prevent the IT-approved apps from being removed from the devices? To prevent users from removing apps from the devices, create a profile with the restriction "Uninstall Apps" as disabled. This method can be used for both iOS and Android devices.
How to track only the devices of a few employees of my organization? To track only a particular group of devices-
1. Go to "Geo-Tracking" and select "Always" for "Track Devices" option.
2. Under the "Apply geo-tracking for" option, selct "Selected groups".
3. Select the group whose devices are to be tracked.
What is the difference between registering with G-suite and without G-suite for Play for Work?There is not difference between these two options with regards to the functionalities offered by Mobile Device Manager Plus. It is recommended to use G-suite to register if the organization has a G-suite account.
How can we prevent users from removing ME MDM app from the devices?
In the case of Android devices, the user can enable "Prevent users from removing ME MDM app from the device" option under "Enrollment Settings".

In the case of supervised iOS devices, Under "Profiles", Disable the restriction "Uninstalling Apps". This will prevent the users from deleting apps from the devices.
Can the licenses purchased for apps from Apple Business Manager (ABM), be reused?
The licenses purchased using Managed Distribution, from ABM can be reused. If an app is distributed to a device, a license will be used. Once the app is removed from the device, the license will be added back to your account and can be used to distribute an app to another device.
Can we manage app configurations using Mobile Device Manager Plus?
Mobile Device Manager Plus allows admins to send out various app configurations to devices along with the apps. This is supported for both iOS and Android apps. These configurations can be applied only if they are provisioned by the respective app developer.
What are the pre-requisites to setup Conditional Exchange Access?
Only if you are using Exchange Server 2010, enable Basic Authentication to configure Conditional Exchange Access. Follow the steps given here to configure it.
How often is the device's location registered to the MDM server? Can we export the location history of devices?
The admin can choose the displacement of the device upon which the location is to be tracked. The location history of the devices can be exported as a CSV file.
Does MDM support Apple Business Manager?
Yes, Mobile Device Manager Plus provides support for Apple Business Manager.
Can the location of a device be tracked if the Location Services are turned off on the device?
In case of supervised devices, the location can remotely be turned on from the server when needed. In addition, in case of Android devices, turning off the location services can be restricted by navigating to Profiles-> Restrictions->Location Settings.
Can paid App Store apps be pushed without the users' iTunes credentials?
Both paid and free apps can be distributed to iOS devices by integrating Mobile Device Manager Plus with Apple Business Program. This service is provided by Apple free of cost. The advantages of ABM are that we can distribute these apps in bulk without any user intervention. The user doesn't need to associate an iTunes account with the devices.
Can the users customise their apps and data even if the device is supervised?
Supervision provides admins additional control over iOS devices like silently distributing apps. Supervision does not restrict the users from customising their apps or data as long as it complies with the organization's policies.
Can Mobile Device Manager Plus track lost devices if they have been switched off?
Mobile Device Manager Plus can track devices when they contact the server. If the location tracking command has been initiated from the server, it will provide the location of the device when it is turned on the next time.
If we have webpage based apps, is there any way to pin this page as an icon to the device?
Mobile Device Manager Plus provides admins the options to pin webpages to the user's homescreen using a feature called web shortcuts. This can be applied by navigating to Profiles->Web shortcuts and adding the webpages to this policy.
Can an app be installed both within and outside container? For example camera for personal or company pictures?
Yes, that's possible. If the app has been distributed by the admin using Mobile Device Manager Plus, it'll be available in the container. If the user installs the app, it'll be available outside the container.
Does every remote session have to be approved by the user?
Users will have to approve a remote session at least once. While approving the session, they can choose to approve just the current session or all the sessions by clicking on "Do not show again."
Does Mobile Device Manager Plus help manage contacts on Android and iOS devices?
Admin can distribute and update contacts on iOS devices by configuring Contact Sync profile, which makes use of CardDAV to manage contacts. Contacts on Android devices can be synced while creating an Exchange ActiveSync profile.
Can Google apps be distributed to devices if all Google services are blocked on it?
The apps can be distributed only if the .apk file is uploaded to the Mobile Device Manager Plus App Repository.
Can apps be blocklisted without being discovered in the network?
To Blocklist apps that are not currently available on any device, the admin can manually add the apps to the App Repository and Blocklist them.