List of possible alerts in Essentials MDM
Name of the alert | Default status | Description |
A DEP device requires admin approval | Moderate | This alert indicates that a device enrolled through Apple's Device Enrollment Program (DEP) needs administrator approval before it can be fully configured and managed. |
APNs certificate about to expire | Moderate | The Apple Push Notification service (APNs) certificate is used for communication between devices and the MDM server. This alert warns that the certificate is close to its expiration date. |
APNs certificate expired | Important | This alert notifies that the APNs certificate has expired, which could lead to communication issues between devices and the MDM server. |
Agent removed by user | Minor | Indicates that the MDM agent (software) on a device was manually uninstalled by the user. |
An existing user in the system was removed from synchronization server | Moderate | A user who was part of the synchronization process with the MDM server has been removed. |
Another device reported same UID | Minor | The device reported the UID number that already exists in the system. |
Apple Push failure | Important | Communication failure between the MDM server and Apple's Push Notification service, affecting device management commands. |
Application requires re-accepted policy | Moderate | An installed application requires the user to re-accept the MDM's policy to continue functioning. |
Application was uninstalled | Moderate | Alerts when a specific application managed by the MDM system is uninstalled from a device. |
CA certificate about to expire | Moderate | The Certificate Authority (CA) certificate used for encryption and security is nearing its expiration. |
CA certificate expired | Important | The CA certificate has expired, which could impact the security of communication between devices and the MDM server. |
Cannot enroll a device | Important | Indicates a failed attempt to enroll a device into the MDM system. |
Connection attempt by blocked device | Important | A blocked device is attempting to connect to the MDM server. |
DEP token about to expire | Moderate | The token used for Apple's Device Enrollment Program is close to expiration. |
DEP token expired | Important | The DEP token has expired, which could disrupt the enrollment process for new devices. |
Data restore request | Minor | A request to restore data on a device has been initiated. |
Deny list application | Important | An application that's on the deny list has been detected on a device. |
Device detached from MDM | Important | The device has been removed from management by the MDM system. |
Device firmware update available | Moderate | An update for the device's firmware is available. |
Different IMSI/serial number | Minor | IMSI or serial numbers reported from the device are different from what's expected, which could indicate tampering. |
Different WLAN MAC address | Minor | The WLAN MAC address on the device is different from what's expected. |
Disabled app monitor service | Important | Application monitor has been disabled on the device |
Disabled location services | Moderate | Location services on the device have been turned off. |
E-FOTA license about to expire | Moderate | The license for Enterprise Firmware-Over-The-Air (E-FOTA) is close to its expiration. |
E-FOTA license expired | Important | The E-FOTA license has expired, affecting the ability to manage device firmware. |
EAS user device was not found | Minor | A device associated with an Exchange ActiveSync (EAS) user was not found. |
EAS user was not found | Minor | The EAS user could not be located. |
ELM reported license status change | Important | The Enterprise License Manager (ELM) reported a change in license status. |
Enabled app monitor service | Minor | The app monitor service has been enabled. |
Essentials MDM iOS Agent was uninstalled | Minor | The Essentials MDM iOS Agent was manually removed from the device. |
ESSENTIALS MDM permission turned off | Important | Permissions for ESSENTIALS MDM have been turned off. |
Forced device firmware update (EFOTA) has failed | Important | A forced firmware update for a device has failed. |
IMEI numbers don't match | Important | The IMEI numbers reported by the device do not match expected values. |
Inactivity time exceeded | Moderate | The device inactivity time specified in the policy has been exceeded. |
Invalid SafetyNet attestation timestamp | Moderate | SafetyNet attestation timestamp is invalid, affecting device security compliance. |
Jailbreak/Root warning for device | Important | A device has been detected with jailbreak or root access, potentially compromising security. |
KNOX reported license status change. | Important | The license status for Samsung KNOX has changed. |
MDM profile has been removed | Moderate | The MDM profile on the device has been removed. |
Malicious application detected | Important | A malicious application has been detected on a device. |
Managed Google Play Account removed | Important | A Managed Google Play Account has been removed from the device. |
Managed Google Play account expired | Important | The Managed Google Play account has expired.
|
Monitor has been disconnected from the device | Important | A monitoring service has been disconnected from the device. |
New zero-touch devices | Moderate | New devices have been added to the zero-touch enrollment. |
Non-allow application list | Important | An application not on the allowed list has been detected on a device. |
Premium license will expire soon | Important | The premium license is nearing expiration. |
Rejected remote access privacy policy | Moderate | The privacy policy for remote access has been rejected. |
Reported the same IMEI | Minor | Multiple devices have reported the same IMEI, which could indicate an issue. |
SIM card must be merged with existing one | Minor | SIM cards need to be merged with existing records. |
SafetyNet attestation - not valid ESSENTIALS MDM Base Agent integrity | Important | SafetyNet attestation indicates that Essentials MDM Base Agent integrity is not valid. |
SafetyNet attestation - not valid device integrity | Important | SafetyNet attestation indicates that device integrity is not valid. |
Screen capturing rejected by the user | Moderate | The user has rejected screen capturing on the device. |
Security restrictions rejected | Important | Security restrictions imposed by the MDM have been rejected. |
Tech support request | Moderate | A tech support request has been initiated. |
Too many active devices per user | Important | The number of active devices per user has exceeded a threshold. |
UID numbers don't match | Important | The UID numbers reported by the device do not match expected values. |
USB debugging mode was enabled | Moderate | USB debugging mode has been enabled on the device. |
Unauthorized connection attempt | Moderate | An unauthorized connection attempt to the MDM server has been detected. |
Unknown EAS device identifier | Minor | An unknown Exchange ActiveSync (EAS) device identifier was detected. |
Usage monitor license exceeded | Important | The usage monitor license has been exceeded.
|
User disagreed license agreement | Moderate | The user has disagreed with a license agreement. |
Work profile removed from the device | Important | The work profile has been removed from the device. |
Wrong device clock settings | Moderate | The device's clock settings are incorrect. |
Zebra integration auth error | Important | An authentication error occurred during Zebra integration. |
Zero-touch Terms of Service | Moderate | Terms of service in ZT portal have changed. You need to login and accept them to continue using ZT services. |
Zero-touch synchronization failed | Moderate | Synchronization of zero-touch enrollment data has failed. |
How to manage alerts in Essentials MDM
Alerts icon is shown in the top right corner in the GUI.
When you click on it, you will see all recent notifications. You can use filters based on date or notification status.
They are automatically sorted by importance (Important, Moderate, Minor, News). When you click on a category and hover over specific alert action icons will be displayed:
- Mark as read
- Mark as ignored
- Resolve issue
When you click on an alert you will see further details - device IMEI number, device user, device model, date of creation, platform and additional message.
The last icon will be displayed only for some notifications, for which ESSENTIALS MDMsuggests some automatic solutions.
Clockwork icon on the notifications tab displays notifications settings.
You can customize the notifications panel here e.g. set Priority of specific alerts, choose whether you want them to be reported or suggest Autofix action.