Essentials MDM Support Center

BYOD / WPC policies 
 New option on Policies tab – BYOD/WPC policies, on which default and custom policies list is displayed. In current version list allows to customize columns and open details of the policy.

You will then have to choose between editing the existing default policy or create a completely new one.

To create a new BYOD / WPC policy, tap the +-sign to the left. When creating a new one, you will have to give it a name and set a Policy priority:

On the left side you will find several options available:
 

General settings

In the General settings you will find the following options:

1. Reinstall base agent (Yes/No)
2. Uninstall not compatible policy components automatically (Yes/No)
3. Enable Samsung Premium API
   1. When set, Premium license field, Premium license expiry date and Enable Samsung attestation additional options appears.
   2. Premium license and expiry date are required.
4. SafetyNet attestation
   1. Enabling this option will make impossible to enroll devices with unlocked Bootloader.
   2. Administrator can set the interval of the device attestation.
5. Mark as wiped on Base Agent uninstallation (Yes/No)
6. Enable remote access services (Yes/No)
   1. When set, administrator can set visibility of the remote session initialization consent with such values:
      • Managed by user
      • Require on every connection
      • Automatic connection
7. Enable location services (Yes/No)
   1. When set, administrator can set:
      • Location interval
      • Disable location reporting on off-peak
      • Disable location reporting after agent installation
8. Ignore battery optimization for Location monitor and Usage monitor
   1. Selecting this option sends an operation that requires user confirmation
9. Report additional data about apps (app size, cache size, data size)
    (This option requires the Usage Access permission to be enabled)
10. Report all applications (option available for iOS devices)
    1. Report all applications
    2. Report only managed applications
       1. Peak days
          
       2. Device Monitor sessions interval
          
       3. Peak time
          
       4. Device Monitor sessions interval
          
       5. Number of stored Device Monitor sessions
          1. 5-50
       6. Data reported in Device Monitor session (Android)
          
       7. Wipe on exceeded device inactivity (Yes/No)
       8. Marked as wiped on exceeded device inactivity (Yes/No)
       9. Time sync interval
          
       10. Sim change notify (for example if device was stolen) (Yes/No)
            SMS Gateway number (SIM change notification)
       11. Device limit per user (Numeric, 1-999.999)

Policy Components

Here you can add components to your policy. You can choose between application or configuration.
.

. 

Security options

Security Options are divided into “Device security options” and “Work profile security options”

On BYOD devices, only work profile security options are applied, on WPC devices (work profile on company owned devices) both options are applied.

There are several security options to secure the devices in the BYOD/WPC. You are also able to perform a search or filter on BYOD, WPC, iOS, iPadOS and MacOS.
 

Device security options

1. Wipe policy:
   1. Data wipe on SIM card change (Yes/No) 
   2. Wipe on no SIM card detection (Yes/No)
       (Data wipe on SIM card change must be enabled)
   3. Wipe on root detection (Yes/No) 
   4. Factory reset protection (FRP)
      

1. Network policy:
   1. Wi-Fi lock (Yes/No) 
   2. Manual Wi-Fi configuration lock (Yes/No)
       (Wi-Fi lock must be enabled)
   3. Prevet Wi-Fi from being turned on (Yes/No) 
   4. Bluetooth lock (Yes/No) 
   5. Cellular data lock in roaming
      
   6. Block outgoing calls

1. Block Bluetooth config (Yes/No) 
2. Block tethering config (Yes/No) 
3. Block mobile networks config (Yes/No) 
4. Block cell broadcast config (Yes/No) 
5. Disable SMS messages (Yes/No) 
6. Disallow cellular 2G (Yes/No) 
7. Disallow Ultra-Wideband (UWB) (Yes/No) 

1. Location policy:
   1. Disable location config on device (Yes/No) 
   2. Disable location sharing on device (Yes/No) 

1. Update Policy
   1. Enable Zebra OTA updates (Yes/No) 

1. Hardware policy
   1. Block safe mode (Yes/No) 
   2. Block airplane mode (Yes/No) 
   3. Enable UB debugging (Yes/No) 
   4. Block screen capture (Yes/No) 
   5. Block USB file transfer (Yes/No) 
   6. Disable mounting on the physical external media (Yes/No)

1. Installer policy
   1. Unknown sources lock (Yes/No)

1. Application restrictions
   1. Block application voice recording on device (Yes/No) 
   2. Force automatic date and time (Yes/No) 
   3. Application policy on WPC device 

1. Disable content capture on device (Yes/No) 
2. Disable content suggestions on device (Yes/No)
   
    

Work profile security options

1. Wipe policy:
   1. Enterprise wipe on SIM card change (Yes/No) (WPC/BYOD)
   2. Enterprise wipe on no SIM card detection (Yes/No) (WPC/BYOD)
       (Data wipe on SIM card change must be enabled)
   3. Enterprise wipe on root detection (Yes/No) (WPC/BYOD)

1. Network policy:
   1. Disable VPN settings (Yes/No) (WPC/BYOD)
   2. Disable managed networks settings change (Yes/No) (WPC/BYOD)
   3. Monitor list of the managed Wifi configurations (Yes/No) (WPC/BYOD)
      
       
2. Hardware policy
   1. Disable Siri (Yes/No)
   2. Disable Siri when device is locked (Yes/No)
   3. Disable connections to Siri servers for the purpose of dictation (Yes/No)
   4. Disable connections to Siri servers for the purpose of translation (Yes/No)
   5. Disable automatically submitting diagnostic reports to Apple (Yes/No)
   6. Disable Control Center from appearing on the Lock screen (Yes/No)
   7. Disable backup of Enterprise books (Yes/No)
   8. Disable Enterprise Book metadata sync (Yes/No)
   9. Disable notifications history view on the lock screen (Yes/No)
   10. Disable today notifications history view on the lock screen (Yes/No)
   11. Disable managed applications to use the iCloud (Yes/No)
   12. Force devices receiving AirPlay requests from this device to use a pairing pass (Yes/No)
   13. Force encrypted backup (Yes/No)
   14. Force wrist detection on Appe Watch (Yes/No)
   15. Force to set lock code (Yes/No)

1. Encryption policy (Yes/No)
   1. Internal storage encryption (Yes/No) 

1. Installer policy
   1. Application installer lock (Yes/No) 
   2. Accounts creation using Google Play (Yes/No) 

1. Application restrictions
   1. Application voice recording lock (Yes/No)
   2. Do not allow to share managed documents using AirDrop (Yes/No)
   3. Do not allow to share data from unmanaged apps (Yes/No)
   4. Do not allow to share data from managed apps (Yes/No)
   5. Allow unmanaged apps reading from managed contacts accounts (Yes/No)
   6. Enable 'Do not allow to share data from unmanaged / managed apps' restrictions for copy and paste functionality (Yes/No)
   7. Disable app uninstallation (yes/No)
   8. Enable Safari fraud warning (Yes/No)
   9. Disallow config default applications (Yes/No)

1. Application policy
   1. The auto-update Managed Google Play apps policy settings
      
   2. Applications availability in the MGP store
      

1. Work profile restrictions
   1. Enable unknown sources (Yes/No)
   2. Block screen capture (Yes/No)
   3. Disable accounts modification (Yes/No)
   4. Block creation of the mail account (Yes/No)
   5. Block creation of LDAP account (Yes/No)
   6. Block creation of Samsung account (Yes/No)
   7. Disable camera (yes/No)
   8. Disable cross profile copy-paste (Yes/No)
   9. Disable application control (Yes/No)
   10. Disable one lock code (Yes/No)
   11. Allow moving apps to work profile (Yes/No)
   12. Block NFC (Yes/No)
   13. Disallow outgoing beam using NFC (yes/No)
   14. Allow moving files from device to work profile (Yes/No)
   15. Allow moving files from work profile to device (Yes/No)
   16. Block change of the sharing of the calendar to the personal mode (Yes/No)
   17. Block change of the sharing of the calendar to work profile (Yes/No)
   18. Enable Bluetooth (Yes/No)
   19. Enable file sharing via Bluetooth in work profile (yes/No)
   20. Block Share Via List (Yes/No)
   21. Prevent users from configuring credentials in the managed keystore (Yes/No)
   22. Maximum time the work profile is allowed to be turned off

1. Enable the ability to restore of the backup from the Google account (yes/No)
2. Disable location config (Yes/No)
3. Disable location sharing (Yes/No)
4. Disable content capture (Yes/No)
5. Disable content suggestions (Yes/No)

1. Work profile applications permissions
   1. Runtime permission policy

1. Application permissions exceptions
   • Administrator can add exceptions to the global permission policy. For each application we can set exceptions for permissions categories:
     • Calendar
     • Camera
     • Contacts
     • Location
     • Microphone
     • Phone
     • Sensors
     • SMS
     • Storage
     • Physical activity

1. Samsung KSP
   1. Enable Samsung Knox Service Plugin (Yes/No)
      • When set, we can option configuration of the Samsung Knox Service Plugin

Enable applications and widgets

1. Enabled applications – applications available in work profile after device deployment, possible options:
   • Gmail
   • Microsoft Outlook
   • Google Calendar
   • Google Camera
   • Google Photos
   • Phone
   • Messages
   • Google Drive
   • Contacts
   • Downloads
   • Google Maps
   • Clock
   • Bixby
   • Samsung Galaxy Store
   • Netflix
   • One Drive
   • Youtube
   • Facebook
   • Google Chrome
   • Your Phone Companion – Link to Windows
   • Google Duo
   • Files
   • Samsung Internet Browser
   • Samsung Notes
2. Enabled widgets of work profile applications – list of enabled widgets available in work profile

Usage Monitor

1. Enable usage monitor services (Yes/No)
    The Android Usage agent monitors and reports user activity to the Essentials MDM server, records outgoing and incoming voice calls, and gives insight into outgoing and incoming text and MMS messages. Essentials MDM Usage Monitor installation is like Base Agent installation.
   1. Report device data after restart of the device (Yes/No)
   2. Package data settings
      Report data traffic using Wi-Fi
      
2. Extended reporting settings
   1. Report device state (Yes/No)
   2. Report screens unlock/lock time (Yes/No)
   3. Report application usage (Yes/No)
      Report extended parameter
      

Backup settings

1. Backup synchronization settings
    Backup items – sets the backup items that will be included in policy (Supported only backup of the contacts)
   1. Backup interval
      
2. Business contact synchronization
   1. Basic synchronization type
      
   2. Contacts synchronization of the additional groups
      This will let you add users from the user groups in the system
      
   3. Business contacts sync interval
      
   4. Default mobile number of business contacts
      

Agent settings

Here you are able to set a handful of values to be displayed in the agent.

1. Organization name displayed on the device
   1. This makes you able to configure the organizations name on the device, i.e., Techstep
      
   2. Select optional field
      
2. Show additional filed on agent´s main panel (Yes/No)
    (Available for Android and macOS devices)
   1. Value of the additional field on agent´s main panel
      
   2. Device details fields in agent (Available for Android and macOS devices)
       

Continuous parameter reporting and alerting

This will let the system report several parameters from the device, like Charger state, Battery level, Memory RAM Free, Battery voltage, Battery temperature, Battery condition and low battery level.

1. Parameter reporting
   
   1. Report only in peak
      
   2. Report all the time