Frequently Asked Questions 

Enrollment

1. What are the pre-requisites for Device Enrollment?

   The prerequisites for enrolling a mobile device are:

   • Creating APNs (applicable only for iOS)
   • Configuring Proxy Settings (On-premises only)
   • Configuring Mail Server settings (On-premises only)
   • Setting up the user authentication type.
   • The device that needs to be enrolled should be accessible through the internet in order to receive the email with enrollment settings.
2. What are the pre-requisites for Self Enrollment?

   End user should have the following for self enrolling a device.

   • Connection to the Internet
   • Self Enrollment URL
   • Active Directory Authentication.
3. Do I need to re-enroll my mobile devices after changing the Public IP address for NAT settings? (On-premises)

   No, You need not re-enroll the managed mobile devices, because the mobile devices will reach the Mobile Device Manager Plus server using the external IP.

4. Why does my Android device show the error "Device already provisioned", when trying to enroll a device using NFC enrollment?
   Android devices running 5.0 or above, enable an implicit Activation Lock by default on associating a Google account with the device. When the device is corporate/complete wiped, the device retains the Google account details and the Activation Lock is still enabled. So on trying to enroll this device after wiping using NFC enrollment, the error "Device already provisioned" is displayed, as the device is already associated with a Google account. The implicit Activation Lock can be disabled only by providing the Google Account details, associated with the device previously.
5. Why have the users not received the join organization mail yet, despite having sent an enrollment request?
   • Ensure all the pre-requisites listed here have been configured.
   • The mail could have fallen into the Spam/Junk folder. Verify the same and if yes, change the e-mail spam/junk filter criteria.
   • Verify your anti-virus configuration to ensure it has not blocked the enrollment requests from being sent.
   • Verify POP/IMAP configuration setup in the router web interface, if configured. Ensure it is not blocking the enrollment requests from being sent.

   Verify if Restricted Sign-in is disabled on the OneAuth app present on users' devices, even if you have not enabled two-factor authentication. If the issue is not still persists, contact MDM Cloud Support (mdmcloud-support@manageengine.com).

6. I want to change the e-mail address with which I signed up on MDM Cloud. How to do that?
   • Open this link and sign in with the Zoho account if need be.
   • Specify the new e-mail address.
   • A verification mail is sent to the new e-mail address.
   • Once verified, MDM automatically updates the new e-mail address.

   In case you need to make a secondary e-mail address as primary, click on the mail icon present against the mail address. This makes the selected e-mail address as primary.

   In case you want to change the e-mail address of any technician, you follow the same process mentioned.

    
7. One of my organization users signed up with MDM Cloud, instead of enrolling the device. How to have the device enrolled?
   • Open this link and sign in with the Zoho account, if need be.
   • Click on Delete Organization present under Dashboard
   • Click on Delete to remove the user-created MDM account. Note that, this also removes all the Zoho services which has been configured with this account. If the user is utilizing Zoho services for personal use, this also gets deleted. If the user is unsure about the services being used with the Zoho account, contact support(mdmcloud-support@manageengine.com)
   • After the account is deleted, sign out of Zoho Accounts and close the browser window.
   • Follow the instructions specified in the enrollment mail, to proceed with the enrollment.
8. What are the pre-requisites for adding users or enrolling devices?

   In case multiple teams(referred henceforth as org) in your enterprise use any Zoho service, follow the instructions specific to your scenario.

   • If the user doesn't have an existing MDM account, the user can access the link in the invitation to join the org.
   • If the user is already a part of another org, the user must ask the super admin of this org to remove the user. The user can then access the link in the invitation to join the org.
   • If the user is the super admin in the other org, the user must assign another user as super admin. The new super admin must remove the user. Now, the user can access the link in the invitation to join the org.
   • If the user is the only active user in the other org, the user must delete the org account as explained here. Now, the user can access the link in the invitation to join the org.
9. Why do I get a page titled "Welcome to Device Enrollment", when I try to access MDM Cloud or try enrolling a device?

   If this page is displayed when trying to enroll a device, ensure your accessing the appropriate enrollment URL from the device to be enrolled.
   If this page is displayed when trying to access MDM Cloud, ensure your MDM Cloud admin has added you as a user.

10. How can we unmanage a device enrolled using ABM/ASM?

    A device enrolled using ABM/ASM cannot be unmanaged simply by factory resetting the device. To unmanage this device, we first need to remove the device from the ABM server and then reset the device in Recovery Mode.

11. What are the prerequisites that need to be met before using Apple Configurator to enroll iOS devices?

    Ensure the following before enrolling devices using Apple Configurator:

    • If the devices to be enrolled are bought from authorised reseller and ABM is available in your country, it is recommended to use ABM for enrolling these devices.
    • If the devices to be enrolled were already in use, check if Activation Lock is disabled by going to Settings -> iCloud and turning off Find my iPhone.
12. How to undo Supervision in iOS devices and Device Owner provisioning in Android?

    Both Supervision as well as Device Owner provisioning lets the Administrator leverage additional control over the managed devices. It can be undone by factory resetting the device.

13. How can we modify the username and email address of enrolled devices?

    Mobile Device Manager Plus allows the admins to modify the username and email address associated with enrolled devices without having to re-enroll the devices. To modify the associated credentials follow the steps given below:

    1. Navigate to Enrollment and find the device whose user details has to be modified
    2. Under Actions select the Re-assign user option
    3. Enter the new user name and email address and Save.

    Modifying the user details will reassign the account based profiles to the new email address.

14. Can devices not purchased from authorised resellers be enrolled using Apple Enrollment Program?

    iOS 11 and above devices can be enrolled into ABM using Apple configurator, even if they aren't purchased directly from Apple or authorised resellers. Follow the steps given in this document to enroll these devices.

15. Why do I get an unexpected error when I try enrolling iPads using Apple Configurator?

    This error is usually encountered when you have enrolled iPhones previously using Apple Configurator. In case of iPhones, Apple Configurator fetches the IMEI and thus, in case of iPads it tries to fetch the IMEI(which is not available for iPads) and shows an error. In such cases, you can factory reset the device using Apple Configurator and retry the process.

16. Why do I need to encrypt my device for provisioning devices as Device Owner/Profile Owner?

    Data encryption is mandated by Google for provisioning Android devices running 5.0 or later versions and 6.0 or later versions. Only for devices running 7.0 or later versions is encryption not required for provisioning the device as Profile Owner/Device Owner.

17. During enrollment, why does the MDM Profile state Not Verified though it is signed by ManageEngine?

    When the third party SSL (Secure Sockets Layer) certificates are not imported to the server, the communication between the MDM server and the ME MDM app is not secure. To establish a secure connection, the user has to manually trust the certificates during MDM profile installation. To automate this, SSL certificates signed by a valid Certificate Authority is to be imported to the MDM server. This will verify the MDM Profile installation during enrollment.

    NOTE: The error Not Verified does not alter any of the functionalities offered by Mobile Device Manager Plus.

18. What are the benefits of enrolling iOS/Apple devices using Apple Business Manager (ABM) instead of using Apple Configurator, Self Enrollment, or Invites?

    By enrolling devices using ABM, you can leverage additional features such as,

    • Out-of-the-box enrollment
    • Mandatory device management - Enrollment cannot be revoked even on device reset
    • One-time setup
    • Automatic user assignment
    • Supervision (Also available in Apple Configurator)

    Click here to learn more about Apple Business Manager. To use ABM for device enrollment, it must be available in your country. Click here to find the list of countries where ABM is supported. To make effective use of MDM, it is recommended to enroll corporate owned devices using ABM or Apple Configurator and employee owned devices using Invites or Self Enrollment.

19. What are the best practices that need to be followed before handing out a device to a new user?

    If you are re-issuing managed devices to new users, you may want to erase all content while keeping the associated apps and profiles intact. To re-issue a managed device, it is recommended to deprovision the device which will wipe the device data and thus remove all the apps and policies associated with the device. After deprovisioning, you have to re-enroll the device before issuing them to employees to ensure that the device is pre-configured with all the requisite apps and policies.

    You can make use of admin enrollment methods like Apple Business Manager (ABM) for iOS devices, Zero Touch Enrollment for Android devices or Knox Mobile Enrollment  for Knox supported Samsung devices to enroll devices remotely. These methods ensure that the device gets automatically enrolled and the profiles and apps are distributed as soon as the users are assigned to the devices.

20. How can I simplify device onboarding if I'm an existing Zoho customer?

    If you are an existing Zoho customer, you can sign up for MDM Cloud using your organization's Zoho account. To enroll the devices, follow the steps given below.

    For Andorid devices, the users can download ME MDM app from Play store.

    1. Once the installation is complete, open the app and click on the Cloud tab.
    2. Specify the Zoho account log in credentials and Owned by details
    3. Accept the Terms and Conditions by clicking Continue.
    4. Enable Device Administrator and click Activate to complete enrollment.

    For iOS devices, you need to enable Self enrollment and enroll using Zoho account credentials.

    You can also enable Conditional Access for Zoho Mail using MDM as explained in this document.

21. Why am I facing errors while integrating my Google Workspace(G Suite AD) with MDM?

    Reason: This issue occurs when you have already integrated Google Workspace(G Suite AD) with MDM and you try to integrate it once again. This integration can either be with MDM on-prem or MDM cloud.

    Solution:

    • You have to sign in into the account which is already integrated and remove the access. To do so,
    • Go to this page and log in to the account.
    • In case of MDM Cloud, Select Manageengine MDM and for On-Premise, select the app name which you have created on the Google Admin Console. Now click on Remove access. 

    

22. How to enable Chrome Device Management API in the Google Admin console?

    Follow the below mentioned steps to enable Chrome Device Management API

    • To enable Chrome Device Management API, login to Google Cloud Console using your admin account.
    • Go to API & Services > Library .
    • In the search bar, type Chrome Device Management API to check if it is enabled.

    

23. How to enable Chrome Policy API in the Google Admin console?

    To enable Chrome Policy API, login to Google Admin Console using your admin account.

    • Go to API & Services > Library.
    • In the search bar, type Chrome Policy API.
    • Click on Enable.

    

24. How to enable Admin SDK API in the Google Admin console?

    To enable Admin SDK API, login to Google Admin Console using your admin account.

    • Go to API & Services > Library.
    • In the search bar, type Admin SDK API.
    • Click on Enable.

    

25. Why am I getting an error "Scopes are insufficient for Google Workspace (G Suite) integration."?

    New policies, restrictions, and inventory actions have been added to Chrome device management features. Integrating Google Workspace (G Suite) with MDM requires specific permissions and scopes. To do this, go to MDM Console > Enrollment > Chrome Enrollment > Integration Details > Re-Integrate.

Profile Management

1. What is the behavior of Restriction policy in iOS devices?

   Mobile Device Manager Plus assures high security through restriction policies. Whenever more than one policy is applied for a same cause, whichever policy provides more security will get applied automatically. For example, assume two restriction policies are assigned to a device, where one is applied to authenticate the usage of camera and the other is to restrict the usage of camera, the policy which assures high security will get applied automatically. So the usage of camera will be restricted in the device.

2. Can a passcode policy forced on the mobile device be revoked by the user?

   No, passcode policy that is forced on the mobile device cannot be revoked by the user. Though users can disable passcode settings on their device, users will be forced to set passcode when the device is unlocked. However if MDM profile is removed from the device the device can no longer be managed by Mobile Device Manager Plus.

3. What do you mean by imposed policies?

   Policies and Restrictions which are applied successfully to the managed mobile device are called imposed policies.

4. What is meant by violated policies?

   Administrator instructs the users to accept the Policies and Restrictions which are pushed to the device. When the user over rules the policies and restrictions, then those policies and restrictions are called as violated policies.

5. What will happen if my device has violated policies?

   When a user overrides the policies and restrictions pushed by the administrator, these policies will be marked as violated policies and will be listed under Violated Policies tab in ME MDM app. The consequence of violated policies differ based on the policy that is violated

   • Passcode: If passcode policy is violated in Device Owner devices, the device will be disabled until the user sets a compliant passcode. In Profile Owner devices, the apps inside the work profile will be disabled until the user sets a compliant passcode. The apps present outside the container or personal apps will remain functional.
   • Add managed account: Managed Account has to be added on the devices for deploying apps using MDM. Managed Account addition might fail when the Play Store or Play Service is not updated. Once the Play Store or Play Service is updated, follow the on-screen instruction to add Managed Account to the device.
   • Location or NFC always on: In Profile Owner devices if Location/NFC is enabled as Always On under Restrictions policy and the user turns it off, the policy will be marked as violated. The user will be prompted to turn on Location/NFC and the policy will remain violated until the user turns on Location/NFC.
6. What is the difference between Idle Timeout before lock and Grace Period for device lock?

   Idle timeout before device lock specifies the time allowed for the device before the screen turns off. This is similar to the settings that can be configured in the device (Settings > General > Auto Lock). Grace period for device lock refers to the time allowed for the user before prompting for a passcode. The screen of the device turns off and when the user slides the arrow to unlock the screen he would be prompted to enter his passcode. This is similar to the settings that can be configured in the device (Settings > General > Passcode Lock).

7. Why can't I backup and restore data on my Android devices?

   Android has restricted backup and restore data functionality in devices provisioned as Device Owner by default. If you want to allow backup and restore, you can enable it using Restrictions profile. In case of Samsung devices provisioned as Device Owner, backup through Samsung Cloud and Smart Switch backup features is restricted by default and can not be enabled.

8. Can OS updates be restricted on managed iOS devices?

   No, Apple doesn't permit MDM solutions to restrict OS updates. However, MDM provides a workaround to prevent OS updates as explained here.

9. Can the user be restricted from changing the date and time settings on iOS devices?

   Restricting users from changing the date and time settings on devices is not permitted by Apple. Mobile Device Manager Plus can restrict the user from accessing any settings by running the device in Kiosk Mode where the device has access only to one app. Another method that can be used is, by ensuring the required apps are dependent only on the network date and time and not the device date and time.

10. How to prevent users from accessing the Settings on the devices?

    In case of iOS devices, the settings can be restricted by disabling the individual settings under Restriction in Profiles. For Android devices, the Settings app can be disabled by disabling the option "Modify default device settings" under Restrictions in Profiles.

    In addition to these methods, user can be prevented from changing any settings by running the device in Single App Kiosk Mode.

11. Can we use Mobile Device Manager Plus to distribute contacts to iOS devices?

    You can make use of the CardDAV profile to distribute contacts to the managed devices. Here you can make use of Google contacts or any other third party service that supports CardDAV.

12. Can we prevent users from adding iCloud accounts to managed devices?

    You can restrict users from modifying accounts on the devices by navigating Device Management -> Profiles -> Restrictions -> Advanced Security and restricting the Modify Account Settings option.

    The user will not be able to modify accounts like mail accounts, iCloud and iMessage settings. If you want to completely restrict iCloud, then navigate to Profiles -> iCloud and restrict it. This will completed restrict the apps from syncing with iCloud and also the device backup on iCloud.

13. Can MDM be used to pre-configure essential settings such as Wi-Fi and E-mail over-the-air without any user intervention?

    Yes, you can configure E-mail, Wi-Fi and other essential settings (such as VPN, Exchange etc.,) across platforms on MDM server and then associate it to groups. Devices added to this group on enrollment, are automatically distributed the configured policies and thus, getting pre-configured on device. Know more about all the policies supported by iOS, Android and Windows in MDM.

14. Can MDM prevent Wi-fi sharing on Apple devices?

    With iOS 11, Apple released a feature that allowed users to share the wi-fi credentials to new devices by bringing two devices running iOS 11 close to each other. Though this feature is useful and allows easy access to personal wi-fi, it can cause problems in corporate scenarios. That is why Apple ensured that any wi-fi distributed through a mobile device management solution cannot be shared to others using wi-fi sharing. Therefore, any wi-fi preconfigured using Mobile Device Manager Plus cannot be shared to other users using wi-fi sharing feature.

15. How can the phone call app be added to Android devices in kiosk mode?

    Users can be allowed to make phone calls and access contacts from Android devices in kiosk mode by adding the respective apps to the kiosk profile. Samsung and other Android devices make use of different package names for this app and hence it is recommended to search for the apps using the following bundle identifiers.

    • Samsung : com.samsung.android.contacts
    • Core Android : com.android.contacts and com.google.android.dialer
16. How to automatically Blocklist websites with inappropriate content?

    Admins can automatically Blocklist inappropriate or malicious content by enabling the checkbox Automatic restriction of malicious content or Automatically restrict inappropriate content under Web Content Filtering for Android and iOS device profiles respectively.

17. On restricting Add/modify iCloud, Mail and other accounts for iOS devices, I am facing password related issues with Email and Exchange ActiveSync policies, configured via MDM. How do I solve this?

               Case 1:

    • The admin configures an Email based profile, and another profile which restricts Add/modify iCloud, Mail, and other accounts, using MDM. On associating these profiles, the user is prompted to provide the email password during the initial setup. If the user closes this prompt before providing the password, it cannot be configured, unless the Email profile is associated again with the device.
    • If the restriction is enabled without OAuth, and Multi Factor Authentication is used, an app specific password needs to be set by the user.
    • Before iOS 16: If OAuth is enabled on the devices, the prompt to enter the Exchange password will not be displayed on the device, and it cannot be configured unless the Add/modify iCloud, Mail, and other accounts restriction is disabled.
    • After iOS 16: You can perform OAuth even if the restriction of Add/modify iCloud, Mail, and other accounts is enabled.
    
    

    Case 2:

    Similarly, if both the Email and Exchange profiles are associated with an iOS device, the mail account is successfully configured during the initial setup. When the password expires, the device does not prompt/allow the user to change it. The workaround is to re-associate the Email profile to the device, since Apple has not provided any solution for this.

     

18. What to do if the admin or user forgets the passcode for iOS devices?

    If the admin forgets or does not know the passcode, the only solution is to clear the passcode in the MDM server. If wrong passcodes are entered multiple times, the device will be disabled. After the device is disabled or locked by Apple if the device is switched off or restarted, the device will lose connection with the MDM server and the remote commands such as remove passcode issued from MDM server will not be executed on the device.

19. How can you override Guided Access on iPhone/iPad?

    Guided Access can be overruled using the following methods:

    • Single App Mode profile:
      By associating a Single App Mode - Kiosk profile with the device, Guided Access can be overruled. Once this is done, disassociating the profile will return the device to it's original state.
    • Lost Mode:
      Activating lost mode on the device also removes Guided Access. Once Lost Mode is de-activated, the device will be back to normal.

    
    Note : The above mentioned steps are only possible for supervised devices. To manually remove Guided Access, force restarting the iPhone/iPad will bring the device back to normal.

     

20. Is it possible to apply profiles created for one platform to devices running on another platform?

    No, the profiles deal with specific device functionalities and are platform dependent. Therefore they cannot be applied to different platforms.

21. I want to apply different policies as different profiles. Is it possible to apply multiple profiles to devices?

    Yes, multiple profiles can be applied to devices. We recommend applying all account based policies as one profile and the restrictions as separate profile, as every time a modified version of the profile containing all these policies is re-distributed, the passcode for the account-based services such as Exchange and configurations such as Wi-Fi preferences, previously synced mails etc., specified in the account-related policies is reset and has to be manually entered by the user again.

22. What will happen if I apply profiles with contradictory restrictions to devices?

    For iOS devices, the most secure profile will be associated. Whereas in the case of Android devices, the most recently applied profile will be applied. For instance, if you distribute profile A with camera disabled and profile B with camera enabled, profile B will be applied on Android devices since that is the most recent. While in Apple, profile A will be associated since that is the most secure.

23. Is it possible to restrict users from adding VPN configuration from third party VPN apps?

    Restrict users from installing third party VPN apps as users can bypass the VPN restriction. You can blocklist VPN apps by navigating to Inventory -> Apps (Choose the VPN apps to be blocklisted) -> Blocklist.

24. Troubleshooting tip for successful migration of the device from one server to another.

    One should always choose the device to be activated by the "Admin" to ensure a successful migration procedure of the device from one server to another.

25. What to do when iCloud sign out is greyed out?

    The iCloud sign out will be greyed out on the device if Screen Time is enabled on the device. In that case, turn off the screen time from device settings to enable iCloud sign out.

App Management

1. What is the difference between App Store Apps and Enterprise/In-house Apps?

   App Store apps are those which are available in the App Store. They can be either paid App or free app. Enterprise apps, also called as In-House apps are specially developed and designed for every Enterprise. This is unique and completely owned and distributed by the Enterprise itself.

2. How to disable App Store on the managed devices, without affecting the installation of apps distributed via MDM?

   You can restrict App Store on managed devices, by creating a profile and navigating to Restrictions -> Applications and restricting Users can install apps from App Store. This ensures only apps distributed through MDM can be installed on the device(must be running iOS 9.0 or later versions). If this is restricted for devices running other OS versions, even MDM-distributed apps cannot be installed on the device.

3. What is Volume Purchase Program (VPP)?

   Volume Purchase Program(VPP) is used for purchasing app licenses in bulk and distributing the same to user either through managed distribution or redemption codes. Know more about Volume Purchase Program here.

4. What is an .apk file?

   'APK' refers to application package file. Android program files are compiled in a package as .apk file, which is used for distributing the apps. When you need to add an android App to the App Repository you need to ensure that the android app is in .apk format.

5. What will happen if I distribute an iOS app to Android and Windows devices?

   Mobile Device Manager Plus app distribution is designed in such a way that you can only distribute iOS apps to iOS devices, Android apps to Android devices and Windows apps to Windows devices.

6. Why should I enable 'Device Administrator' in my Android mobile device?

   Device Administrator should be enabled in the Android mobile device to authenticate Mobile Device Manager Plus Mobile Device Management to perform remote management activities in the device.

7. Can we install App Store apps without entering Apple ID?

   App Store apps can be installed without entering Apple ID, as explained here.

8. Can you revoke the license code after installing the App?

   Yes, with the help of iOS app license management feature in ABM, Mobile Device Manager Plus will let you to revoke and reassign app licenses to the required user device.

9. Why should I renew APNs a month prior its expiry?

   If the APNs certificate has expired, Apple Push Notification service will not be able to contact the managed mobile devices. Renewing an APNs after expiry is the same as creating new APNs, which means all the devices need to be enrolled again to be managed. Assume that the APNs expires on 30th of June, you need to ensure that you renew your APNs well before the expiry date and update it in the Mobile Device Manager Plus server. All the managed mobile devices should contact Mobile Device Manager Plus server at least once before 30th of June. If any of the managed mobile device fails to contact the Mobile Device Manager Plus server, then those devices should be enrolled again. Hence we recommend renewing APNs before a month of its expiry.

10. Why is the renewed APNs certificate unavailable in the devices?

    Devices receive the APNs certificate once they come in contact with the MDM server. There can be a slight delay in the process but that does not affect the communication between the server and the devices. Password-protected devices need to be unlocked in order to contact the server.

11. Should the devices be re-enrolled if the APNs is renewed after expiry?

    The devices need not be re-enrolled. Renewing the APNs certificate is sufficient. It is recommended that the certificate be renewed at the earliest.

12. Should the user have to use the Apple ID password while installing the Apps from App Catalog?

    Yes, the user has to enter the Apple ID to install the apps. To install apps silently or without requiring Apple ID, refer to this.

13. Can I use Mobile Device Manager Plus to force install Apps on the managed Devices?

    Yes, force installation is supported on iOS devices as explained here and supported on Android devices if enrolled as Device Owner as explained here. Android enterprise apps can be force installed in Samsung devices, without any additional configuration.

14. What are the prerequisites for Windows Phone Enterprise App Distribution?

    For mobile devices running Windows 8 and 8.1, the steps to perform App distribution:

    • You have to register a company account on Windows Phone Dev Center and obtain an enterprise certificate from Symantec
    • You should generate an application enrollment token (AET)
    • Upload the generated AET file into the server (MDM -> App repository -> Windows app settings -> App distirbution certificate -> Configure)
    • Before adding enterprise apps in app repository, you have to sign the app using AET. For more details visit help.
15. What is AET? What is its purpose?

    AET refers to Application Enrollment Token. The Windows Phone 8 operating system requires users to enroll each device with the enterprise before users can install company applications on their devices. Only way to achieve this is using Application Enrollment Token, which enables you to distribute enterprise applications on a Windows Phone 8 device. For more information visit help.

16. How to verify the whether a work profile has been installed in the managed Android device?

    Work profiles are installed when Android devices are provisioned as Profile Owner using Android for Work. To verify whether Work profile has been installed in the device, go to Settings, and select Accounts. Work profile is listed under the Work section.

17. How to uninstall a work profile from the managed Android device?

    In Android devices running 5.0 or later versions, go to Settings, click on Accounts and select Remove work profile. Click on Delete to confirm the removal of all apps and data within the work profile.

18. What is the behaviour of app permissions when a device is put into Kiosk Mode?

    Once a device is put into Single App Mode, no permission prompt will be generated. This means that the app cannot access any other features that use camera, contacts, or location services. The admin should allow these settings before putting the device into Single App kiosk.

19. What are the prerequisites to distribute enterprise apps using Mobile Device Manager Plus?

    Follow one of the given methods to distribute enterprise apps using Mobile Device Manager Plus:

    • Enterprise Distribution: If you have a development team which is familiar with developing apps, you can choose this method. Ensure the setting "Save for Enterprise Distribution" is enabled, while the app is being developed.
    • B2B App Distribution: If you do not have the resources to develop the app in-house, you can make use of B2B app distribution. Follow the steps given here for B2B apps.
20. "Security policy restricts use of Smart Switch." error being displayed while trying to setup Samsung Smart Switch app on Samsung Device Owner devices.

    Samsung Smart Switch might not work for all devices as it is not designed for enterprise environments and the only way the app will work is through managed app configurations, kindly refer here for a detailed explanation.
    Note: Smart Switch app should be enabled to run in the managed App configuration, for the app to work normally.

21. What will happen if we move an ABM token from one server to another or if the same ABM token is used in two different MDM servers?

    When an ABM token is removed from a server, the licenses used to distribute the apps will be reverted to your account. When you use this token on another server, the licenses can be used to distribute the apps to the devices.

    It is not possible to use the same ABM token on multiple MDM server, as each MDM server manages the complete set of licenses purchased with the token. This results in the MDM server revoking the licenses of the apps distributed to devices and also removes the apps from the devices.

22. How can we ensure that the user does not install/uninstall apps from managed devices?

    We can prevent the installation and uninstallation of apps from devices by applying a few restrictions to devices.

    1. Under Device Mgmt, select Profiles.
    2. Choose the OS of the device to which the profile is to be applied.
    3. Under Restrictions, click on Applications.
    4. Restrict the options, Install Apps and Uninstall Apps.
    5. Publish and distribute the profile to devices.
23. Does MDM allow enterprise iOS apps to be installed silently, without user intervention?

    Yes, you can install enterprise apps silently on iOS devices, if they are Supervised. Firstly, add the enterprise app source .ipa file to App Repository. Distribute it to devices and/or groups, after ensuring the Force Install option is enabled in Distribution Settings

24. Does MDM allow enterprise Android apps to be installed silently, without user intervention?

    Yes, you can install enterprise apps silently on Android devices as explained here

25. Can MDM be stop and/or control app updates on managed iOS devices?

    Yes, you can stop and/or control app updates on managed iOS devices, if the apps are distributed and installed on the devices through ABM. Also, ensure Without Apple ID is selected during the initial ABM settings. This allows the app to be installed without requiring Apple ID and the app gets associated to the device instead of Apple ID, which is how it is usually associated. As the app is not associated with the Apple ID present on the device, the App Store doesn't notify the users of possible app updates, when distributed through MDM. You can choose to force app updates on the device as explained here

26. Why am I unable to distribute enterprise apps to Xiaomi devices?

    This is an issue on particular models of Xiaomi devices. If you're unable to distribute enterprise apps to Xiaomi devices, follow the steps given below:

    • On the Xiaomi device, navigate to Settings and click on About phone. Now click on MIUI version 7 times.
    • You will see a popup message which says you are a developer now.
    • Navigate back to Settings and then click on Additional settings. Now click on Developer options and scroll down to the option Turn on MIUI optimization and disable it.
    • The device is rebooted. Once rebooted, you will be able to distribute enterprise apps to this device.
27. Can I remove user installed apps using MDM?

    Yes, you can remove apps present on the devices, by blocklisting them as explained here.

28. How can I prevent multiple app shortcuts from being created on Android devices?

    The ME MDM app on the Android devices (running Android versions below 8.0), creates an app shortcut when the app is installed on the devices. In most cases the user has enabled the Add icon to Homescreen option in Google Play Store. This creates another shortcut on the devices. Sometimes, even when the app is updated the existing shortcut is not replaced with a new one, resulting in multiple app shortcuts. This can also happen when specific device launchers are being used.

    To avoid creation of multiple shortcuts, the user should disable the Add icon to Homescreen option from Play Store by navigating to Play Store->Settings->Add icon to Homescreen.

29. How to distribute Apps when all Google services are blocked on the device?

    Upload the .apk file of the app to App repository and distribute it to devices as explained here.

30. Can MDM be used for completely locking down iOS devices?

    Yes, you can choose to completely lock down the device by preventing users for installing/uninstalling apps and ensure only apps distributed via MDM is installed on the device. To lock the device to specific app(s)/settings, you can use Kiosk mode.

31. Can the same app be installed both within and outside the container?

    Yes. An app that is distributed by the admin using Mobile Device Manager Plus will be available in the container. An app that is installed by the user will be available outside the container. For example, you can have a Gmail app inside the container for corporate Email account and outside the container for personal Email account.

32. The version of an app distributed via MDM and the version installed in the device are different. How is this possible?

    This is due to staged rollouts of app updates on the Google Play store. An app developer can release updates only to a percentage of devices, which are chosen randomly. Click here for more information on staged rollouts.
    
    Only the app versions which have completely rolled out (100%) are added to MDM. For example, say a staged rollout for an app is released for 20% of the devices. If the device falls into this category at the time of distributing the app via MDM, this issue of different app versions occurs. The app installed on the device will be of the latest version (The latest rollout), and the MDM server will have the previous version which has completely rolled out.
    
    For apps developed using Google Play's multiple APK support (Listed as "Varies with device"), different APKs are targeted for different device configurations. Each APK of the app is an independent version, but they share the same app listing on Google Play. This might again display different app versions on the server and the device, based on the device type.

    

33. How to Blocklist system apps on iOS devices?

    System apps also known as pre-installed apps can be blocklisted using MDM by following the steps given below:

    • On the MDM console, navigate to Inventory -> Apps.
    • By default, the checkbox Show only installed apps will be checked. Uncheck this to display all apps on the devices, including the pre-installed apps.
    • Search and select the app to be blocklisted. Click on Blocklist app and specify whether the app should be blocklisted for All devices or Specific groups/devices.

     

34. Unable to upload Enterprise app while uploading AAB files.

    Currently we support only APK files. Kindly follow the right syntax while uploading XML files to avoid errors while uploading Enterprise apps.

35. How to purchase paid apps or make in-app purchases using Android for Work ?

    Android for Work (AfW) has stopped supporting paid apps. You can still distribute paid apps using MDM by adding them as Play Store apps (Non-AfW) to the App Repository. Once these apps are distributed to the devices, the user needs to access Play Store using a personal Google account where the apps can be purchased and downloaded. A personal Google account is also necessary to make in-app purchases. If a managed account is used in this place, only the free version of the app can be downloaded and in-app purchases cannot be made. To ensure that the user is able to add a personal account, navigate to Device Mgmt->Profiles->Android->Restrictions->Device Functionality on the MDM server and ensure that Add Accounts is set to Allow.
    NOTE: If there are multiple accounts on the device, the user needs to switch to the personal account to make the purchases.

    

36. How can I restrict users from installing unapproved apps on Android devices?

    This can be done in 3 different ways.

    • Android restrictions: If you want to completely prevent users from installing any apps on the devices, you can disable the restriction Users can install unapproved apps by navigating to Device Mgmt->Profiles->Android->Restrictions->Applications, on the MDM console. This will ensure that only apps distributed by MDM are present on the devices.
    • Blocklist apps: If you want to prevent users from installing a specific set of apps on the devices, you can navigate to Inventory->Apps on the MDM console and select the apps to be blocklisted. In some cases, these apps will be removed from the devices immediately and cannot be installed on the devices again.
    • Kiosk: If you want the users to access only a single app or a specific set of apps and restrict the others, you can provision the devices in Kiosk by navigating to Device Mgmt->Profiles->Android->Kiosk, on the MDM console. Kiosk provisioning prevents users from navigating to other apps on the devices, other than the Kiosk app(s). Additionally, specific device settings and functionality can also be restricted.
37. Why am I not able to distribute app updates to devices even though I am shown an 'App Updates available' notification on the MDM server?

    This is due to staged rollouts of app updates on the Google Play store. An app developer can release updates only to a percentage of devices, which are chosen randomly. Click here for more information on staged rollouts.
    
    Only the app versions which have completely rolled out (100%) are added to MDM. If the device falls into this category at the time of distributing the app via MDM, this issue of different app versions occurs. The app installed on the device will be of the latest version (The latest rollout), and the MDM server will have the previous version which has completely rolled out.

    For apps developed using Google Play's multiple APK support (Listed as "Varies with device"), different APKs are targeted for different device configurations. Each APK of the app is an independent version, but they share the same app listing on Google Play. This might again display different app versions on the server and the device, based on the device type.

     

    

38. Can I manage app bundles using MDM?

    App Bundle is a publishing format that lets developers deliver customizable features with smaller app size. Since MDM does not support distributing App Bundles, host the App Bundle privately to distribute using MDM.

39. Why am I unable to update enterprise apps on my iOS device over mobile data?

    Apple restricts users from updating apps that are more than 200MB in size over mobile data, so by default they get updated over Wifi. This can be changed under App Store-> App downloads -> Always allow.

     

    

40. Why are users able to remove the Managed Account on devices?

    When Managed Google Play is integrated without G Suite on the MDM server, a Managed Account is created on the device. By default, this Managed Account cannot be removed by the user. However,

    • If the Managed Google Play integration is removed from the MDM server, the managed account on the device will be considered invalid and can be removed by the user.
    • If the Managed Account has expired, it can be removed by the user.
    • If an expired account is removed, a new Managed Account will be automatically added on the device.
41. Why am I not able to clear the ME MDM app history from my recently used apps?

    In Samsung devices, MDM restricts users from being able to close the ME MDM app. Once the device is switched on, the app will automatically start running. This is to ensure that the device maintains connectivity with the MDM server and that any policies or restrictions are immediately applied to the device.

     

42. How can I hide notifications from the ME MDM app?

    We recommend that the notifications from the ME MDM app are always on, as these would keep the user informed about imposed policies or violated policies. Notifications can be turned off on the device's settings, but for devices running on Android 8.0 and higher, the notifications will by default be shown to the user. This is a privacy feature enabled by Android.

     

43. Why are certain apps removed after enrolling an Android device as Device Owner?

    MDM enables apps on devices provisioned as Device Owner based on the following conditions:

    • All non-launchable system apps.
    • Launchable system apps provisioned with system signature.

    If an app satisfies the above conditions, but still is not enabled on the device, this can be resolved by distributing the app via MDM. Navigate to App Repository> Add App> Play Store App>enter the Bundle Identifier of the app and save it. This app can then be distributed to the devices.

44. Do I distribute Email/Exchange/VPN configurations through profiles or apps?

    Email, Exchange, and VPN can be configured through MDM by applying profiles, or by distributing the required apps. Profiles with the required configurations can be pushed to the devices, and using dynamic variables, user details will be mapped to the respective devices. However, the required apps for Email, Exchange, and VPN can be provided with app configurations, and distributed to the devices. This ensures that if an app gets a new feature, the user will be able to avail it. Refer this link for more details on app configurations.

45. How to enable Developer Mode on iOS/iPad OS devices?

    To enable Developer Mode

    • Go to Settings->Privacy & Security tab.
    • Scroll down to the Developer Mode list item and toggle Developer mode.
    • Tap the switch to enable Developer Mode
    • You will receive an alert .Tap the alert’s Restart button.
    • After the device restarts and you unlock it, the device shows an alert confirming that you want to enable Developer Mode. Click on Enable and Developer mode will be enabled.
46. Why does my Apple VPP app show different versions?

    The different app versions displayed are the versions compatible with each platform. Each app version is the supported version to that platform.

    Note: The app developer decides whether the app version has to be same or different for each device(iOS, TVOS, macOS).

    

    For example, Here in this case, The version 9.34.8 is compatible with iPhone, iPod and iPad. The version 2.3 is supported for Apple TV.

47. How can I distribute my unlisted iOS app to devices?

    Unlisted apps are apps published in App store that can be accessed with their direct link. These apps are hidden and cannot be found by search.

    You can distribute an unlisted app to devices through MDM via ABM.

    • On the ABM portal, click on Apps and Books.
    • Search for the unlisted app with its App store URL.

    

    • Purchase the app and assign token in MDM.
    • Perform sync in Device Mgmt -> App repository -> Apps. Click on Sync apps and choose Sync Apple apps from the dropdown.
    • Once the sync is completed, the app will be available in the app repository.
    • You can then distribute the app to the devices.

Security Management

1. How can we manage BYOD?

   "Bring Your Own Device" (BYOD) being the integral part of Mobile Device Manager Plus, you can ensure the security of corporate data. Whenever any user's personal device is lost, or the employee quits an organization, administrators can execute security commands like corporate wipe or complete wipe to ensure data security. Hence Mobile Device Manager Plus MDM is a smart choice for every enterprise to manage BYOD.

2. What is difference between Complete Wipe and Corporate Wipe?

   Corporate wipe is a security command used to wipe data on the device. This security command is mostly used to secure the corporate data from devices, when they are lost. Corporate Wipe is used to remove only the configurations and Apps that have been pushed using Mobile Device Manager Plus and this command will not wipe any personal data of the user.

   Corporate Wipe will remove Exchange Server or Email only, if they are configured via Mobile Device Manager Plus. This includes, the files and documents shared using the corporate e-mail.

   Complete wipe command is used to wipe all in the data in the device, which makes the device as good as a new.

3. Can you wipe the data from the device's external memory?

   Yes, you can wipe data on the device's external memory.

4. How to protect Corporate Data on the mobile devices?

   You can secure corporate data on mobile devices by applying the following restrictions:

   • Disabling Screen capture
   • Disabling Backup (iCloud)
   • Disabling Document Sync
   • Disabling Photo Stream
   • Disabling Shared Stream
   • Disabling User to accept untrusted TLS Certificates
   • Forcing Encrypted Backups.
   • Configuring Email settings to restrict data forwarding.

   These restrictions will help you to secure Corporate data on mobile devices.

5. Which are the devices that support the remote control feature?

   Mobile Device Manager Plus allows admins to remotely control Samsung, Sony and Lenovo devices running android 5.0 and above. Remote viewing capability is available for other Android devices above 5.0 and iOS devices.

6. How can I completely disable location tracking in MDM?

   Most organizations prefer to disable geotracking due to user privacy concerns. While admins have an option to track devices only when lost by configuring Geo-tracking Settings, some admins prefer to completely disable location tracking on devices. This can be achieved by navigate to Admin -> Device Privacy. Click on Modify and under Geo-location select Do not collect. Under Applicable Devices, select whether this setting must be applied only to personal, corporate or all devices. Click on Save and MDM would not collect any location details from the managed devices

7. How can I use Active Directory Certificate Services(ADCS) or any other Certificate Authority(CA) for client-based authentication?

   If client-based authentication is enabled in your organization's AD, you can configure the SCEP policy to ensure one-time login for the applications and services that depend on AD, like VPN, Wi-Fi, etc.

8. Why does my email app prompt for password even after configuring certificate based authentication using SCEP?

   Ensure that the SCEP template reflects the same authentication values as configured in the Exchange server. Additionally, for the authentication to work, the client certificate must contain the user principal name(UPN) of the user in the certificate's subject or subject alternative name fields. Refer to this link for more details.

9. Why Conditional Exchange Access is not supported for Outlook?

   Conditional Exchange Access can not be offered for Outlook for the following reasons:

   • Outlook offers access to Exchange email via internet. Since the Exchange mail's credentials and the server URL are stored in the Exchange servers, Outlook relies on the internet to relay requests from a remote client to the Exchange server. This involves the risk of exposing the server directly to the internet.
   • When a device tries to access Exchange mailbox, an EAS identifier will be issued to the device for device identification. The EAS identifiers of devices that are enrolled with MDM are stored in the server and any new connection with unknown EAS identifiers will be blocked from reaching the server. In Outlook app, every time a user uses the same Exchange credentials to login from a different device, the same EAS Identifiers will be issued to the device. This would allow any unmanaged devices to gain access to the Exchange mailbox, thereby introducing security risks.

   Conditional Exchange Access is supported for Native e-mail app in iOS and Windows devices and can be applied for Gmail app in Android devices.

User Management

1. How do I add users(technicians) to manage devices?

   You can associate users to either pre-defined roles or create roles and associate them. Additionally, you can modify the users, their roles and even delete them. Know more about user management here

2. How to add a user and grant the user read-only privileges?
   • On the MDM server, navigate to Admin tab and select User Administration, present under Global Settings .
   • Click on Add User. Provide the required details and specify the role as Guest. This ensures the created user has read-only access.
3. How to change Super Admin privilege from one user to another?
   • Login here with Zoho account. All the services being used by the Zoho account are listed.
   • Click on the pencil icon present against the Super Admin Name, to change the Super Admin, as shown in the image below.

   

   • All the user added administrators on MDM Cloud are listed. Select the new Super Admin. The Super Admin E-mail Address gets modified automatically.

   It is to be noted the Super Admin of all the Zoho services are changed, when this is done.

4. How to delete my MDM account?

   To delete you MDM account, go to the MDM web console and click on Admin tab from the top menu. Now, select Company Details and click on Delete Account. Follow the on-screen instructions to removed your MDM account.

Pricing

1. How to purchase MDM Cloud?
   • On the MDM server, navigate to Admin tab and select Subscription, present under Global Settings.
   • Fill in the number of devices you want to manage and other required details. Click on Buy Now.
   • On clicking, Zoho Store page is opened. Review and confirm your order.
   • Proceed and provide your payment method. On successful completion, your MDM Cloud license will be activated immediately.

   This is a pay-as-you-go Service and can be mended as and when you need. Additionally, you can also purchase offline(Non-Store) by mailing to sales@manageengine.com.

2. How to reactivate my license, if it has expired?
   • On the MDM server, navigate to Admin tab and select Subscription, present under Global Settings.
   • Click on Manage Plan.
   • On clicking, Zoho Store page is opened. Renew your license here.
   • On successful completion, your MDM Cloud license will be activated immediately.

   In case you're denied access to MDM server, click on the Buy Now to proceed with the reactivation.
3. What are the types of payments supported by MDM Cloud?

   Payments are securely done using Zoho Store. MDM Cloud supports payment via Visa, MasterCard, American Express and PayPal. You can also purchase offline(Non-Store), by mailing to sales@manageengine.com.

4. How do I modify my MDM Cloud license?
   • Modify your license by navigating to this link(sign up with the Zoho account, if need be). Click on Manage Plan, which re-directs you to Zoho Store.
   • Hovering on the plan, lets you add/remove the number of devices to be managed. Similarly, hovering on technicians and multi-language support, lets you add/remove technicians and unsubscribe multi-language support respectively, as shown in the image below:
   • Assume you want to add more devices for management. Click on the plan and specify the number of devices you want to manage.

   

   • On specifying the additional devices, the required cost to be paid is displayed. You can then continue with the payment and finish the purchase.

   
5. How to change payment method from offline(Non-Store) to online?

   For changing payment method from offline(purchasing licenses by mailing to sales@manageengine.com) to online,

   • On the MDM server, navigate to Admin tab and select Subscription, present under Global Settings. Click on Manage Plan, which redirects you to Zoho Store. Now click on the Payment Method link as seen in the image below

   

   • Provide credit card details and click on Update, to modify your payment method.
6. How to modify the specified credit card details?
   • Login with the same Zoho account used for signing in with MDM Cloud.
   • All the information about your billing cycle, card details and billing address can be viewed here. Click on Change Card to edit or update your card details

   You can also change the billing address here as well. All your confidential data is secured using VeriSign.