Tags Guide Part III: iPad, iPhone, iPod

Exchange ActiveSync

Email

Passcode

With passcode settings, you can ensure that your users' managed devices are protected from unauthorized third-party access by requiring a passcode, for example. You can also set other security-related settings associated with the passcode configuration, such as the length and complexity of required passwords, or resetting the device to factory defaults after a certain number of failed attempts. 

Restrictions

Restrictions are usually simple on/off settings that extend the configuration options of your managed devices and increase the security options. By enabling or disabling them, users are either authorized or explicitly prohibited from configuring certain settings on the device.

Virtual Private Network

Private APN

If you have a Private Access Point Name (APN) for your SIM Cards, then Silverback has the ability to configure this for you on the managed devices.

Wi-Fi 

Silverback offers the ability to pre-populate multiple Wi-Fi Profile and settings on your devices, so the user does not need to know the password for these networks. If you having a WPA Enterprise protected network (e.g. with a RADIUS Server), please refer to WPA Enterprise Settings  for additional information. 

Wallpaper*

Define a custom Home Screen and Lock screen for your iOS supervised devices. 

Application Lock*

Through the use of the Application Lock feature, you can now ‘Lock’ a specific App to the screen of the device, meaning that the user cannot minimize or close the specified App from the screen. Another common name for this functionality is the kiosk mode or single app purpose mode. Please refer to Single App Mode for iOS and iPadOS devices for additional information.

Notification Settings*

Notification Control specifies the restriction enforced notification settings for apps, using their bundle identifiers. It is supported on iOS 9.3 and later for supervised devices, only. This control offers Administrators the capability to define specific per app notifications on the device. Notifications can be disabled at all or can be permitted to options like sounds only or disallow them in CarPlay. To configure Notification Settings navigate to iPhone, iPod or iPad Profiles in a Tag  and press New Notification Setting. 

Lock Screen Message*

For supervised devices this payload allows administrators to configure Custom Lock Screen Messages. This feature allows placing additional information on the devices lock screen. As an example, you as an administrator could place useful information like the serial number, the device user or the managed by information.

Global HTTP Proxy*

Enabling the Global HTTP Proxy will force all Network Traffic through a designated proxy server.

Web Content Filter*

Web Content Filter settings allow the administrator to control URLs accessible on the iOS7+ devices from browser and web views. Please refer to Web Content Filter for iOS and iPadOS for additional information.

Single Sign On

With Single Sign On you can leverage Kerberos as a network authentication protocol. Kerberos, as the most commonly deployed Single Sign On technology uses Data Encryption Standard to encrypt user credentials. Organizations using directory services such as Active Directory usually have a Kerberos system already in place. Single Sign On is supported for devices running iOS 7.0 or later versions. It is possible to use a Certificate-Based Authentication to ensure users are not required to sign in even once.

App Portal

The Application portal is where devices can access Enterprise applications and recommended Third Party applications via a web clip icon. To enable access to the Application portal for end users and push the app portal web clip icon to devices, ensure App Portal Enabled box is ticked.

Managed Domains

Certificate Trusts

Classroom

Classroom is an app for iPad and Mac that helps you guide learning, share work, and manage student devices. You can launch a specific app, website, or textbook page on any iPad in the class, share documents between teacher and students, or share student work on a TV, monitor, or projector using Apple TV. Classroom Configuration with Silverback for iPads is the payload for configuring users, groups, and departments within an educational scenario. Apple Classroom can be configured in two main ways: Shared iPad or 1-to-1 iPad. The classroom profile in Silverback supports the 1-to-1 scenario and the manual configuration of the classroom profile. In this scenario you don't need accounts on Apple School Manager or Managed Apple IDs and your users will always be keeping the same device with them. Please refer to Classroom Configuration for additional information. 

Custom Profiles

Custom Profiles are a very helpful option to configure additional payloads for your managed devices. You can utilize the Apple Configurator 2 to create custom profiles in a *.mobileconfig format. Additionally, you might create or receive a custom XML from a third-party vendor, like for the Cisco Security Connector Umbrella Setup. Depending on the format or the way how you create or receive the profile, you can either upload the *.mobileconfig to Silverback or add the XML content into the provided section inside the profile. Created profiles with the Apple Configurator 2 can easily be adjusted by replacing the file type to *.txt (e.g., on Windows 10) or opening these files directly with the Text Editor (e.g., on macOS devices). System Variables are supported in the Use XML option or by uploading a *.mobileconfig file that contains a System Variable. Silverback will adjust the XML or the mobileconfig on the fly and convert the System Variables to the individual values and install this payload with the desired content on your devices.

• Click New Custom Profile

e.g.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>AssetTagInformation</key>
            <string>{SerialNumber} </string>
            <key>IfLostReturnToMessage</key>
            <string>Imagoverum</string>
            <key>PayloadDescription</key>
            <string>Configures ownership information for a shared device</string>
            <key>PayloadDisplayName</key>
            <string>Lock Screen Message</string>
            <key>PayloadIdentifier</key>
            <string>com.apple.shareddeviceconfiguration.BAB86918-4FC6-45EE-9BC6-76FC358A115A</string>
            <key>PayloadType</key>
            <string>com.apple.shareddeviceconfiguration</string>
            <key>PayloadUUID</key>
            <string>BAB86918-4FC6-45EE-9BC6-76FC358A115A</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Lock Screen Message</string>
    <key>PayloadIdentifier</key>
    <string>MacBook-Pro.943FF4CE-7A2B-4D4A-9507-1D9000D873B7</string>
    <key>PayloadOrganization</key>
    <string>Imagoverum</string>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>22A0F143-8A4A-49AE-BF2B-6BBAA7D14FC6</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Web Clips

Silverback allows administrators to push down Internet shortcuts to their Managed Devices, giving users easy access to the websites the administrator wants.

• Click New Web Clip

Home Screen Layout 

The Home Screen layout allows Administrators to organize app icons and Web Clips across supervised iOS and iPadOS devices. A unified layout of interfaces makes switching between devices easier and users and support can expects apps to be in the same location on their devices. Apps which aren't used very often can be organized into folders and moved as an example to page 2 or 3 on the devices.  Please refer to Home Screen Layout Configuration for additional information.

OS Version Compliance 

Administrators have the ability to control which OS versions are allowed within their environment. To allow an OS version, simply ensure the checkbox next to the respective OS version is ticked. Enrolling a device with a disabled OS version will result in the device automatically being blocked.

• Alert Administrators: When the checkbox is checked, all administrators will receive an email when a device that violates OS compliance is detected, or when a new OS version is discovered.
• Automatically Approve New OS Versions: When an OS platform is enrolled to Silverback for the first time, the OS is automatically added to the list. By default, unknown OS platforms are disabled and relevant devices will be blocked. To automatically authorize new OS versions as they are discovered, ensure the checkbox is ticked.

Use this feature where you do not want devices to be automatically blocked when a user upgrades their device to a new future OS version that is released by their software vendor.

OS Updates*

A common question that you may face is how can we prevent our devices from updating updating to the latest version of iOS and how can we test the new iOS update before all of our users will install it?  Often, organizations wish to check the latest iOS release, verifying that the business-related apps they use will continue to function properly on the devices used by their organization. Starting with iOS 11.3 and for supervised devices Apple began to offer the possibility to specify a number of days to delay software updates, with a maximum of 90 days. With this option enabled, the user of the device will not see a software update until the specified number of days has passed since the release.

Hardware Compliance 

Administrators have the ability to enforce a hardware compliance policy through Silverback. Simply uncheck the boxes for hardware types that should not be supported and any devices that match the hardware type and are managed by Silverback will be blocked. The list of hardware types is managed via the Device Types option in the Admin Tab of the Silverback Console. If a mapping from device type to hardware type exists, the hardware type will be displayed in the hardware compliance list. When a Device Manufacturer release a new version of their hardware the model numbers may not be known by Silverback, in this case Silverback will ‘learn’ them and store them as ‘Unknown’ in the Device Types section under the Admin Tab where the Administrator can update them manually. To allow these devices into your system you enable the ‘Unknown’ checkbox option. This will allow the device into your Silverback Environment and you can later re-classify this device type in the Admin > Device Types section.

• Alert Administrators:  When the checkbox is checked it will ensure that administrators receive an email when a device that violates hardware compliance is detected.

Application Blacklist

For iOS and iPadOS devices, administrators have two different ways to create an Application Blacklist. The first one is the Silverback blacklist, where the system periodically detects installed applications. In combination with the Lockdown policy, Administrators can decide what action should apply to a device that violates the configuration. The second method is the Enforced blacklist/whitelist for supervised devices where Administrators can easily decide which application should be visible on the device or which applications should not be installed on devices if the public app store is open for users. Please refer to Application Black- and Whitelisting for additional information. 

Lockdown

The Lockdown screen allows you to determine what device compliance policies are enabled and what action should automatically occur when a violation is detected. Each policy is enabled/disabled through their associated checkbox. Enabling a lockdown policy ensures that the device is inspected to ensure it is compliant with that policy during the initial enrollment as well as at regular intervals as defined by the ‘Perform check every’ drop down.

Companion

Companion extends end point security into a secure workspace for your users. Users can store and edit files locally within the application, ensuring that these documents are kept securely and cannot be accessed by other applications or users. Companion also allows users and administrators to manage data usage on the device and configure policy settings around this.

Network Usage Rules

On iOS devices, roaming and cellular data can be enabled or disabled for managed applications either on a per-app basis, or through the use of wildcard bundle identifiers. Managed applications are either distributed with Silverback or has Take management if the app is already installed checkbox enabled in the App Portal. 

After adding Network Usage Rules use Edit button for quick editing (save with Accept button) or use Remove button to remove the application(s). 

Computer Objects

Creates Computer Objects in your Active Directory. You may already be familiar with the automatic creation of Computer Objects after a Computers joins your Active Directory.  Silverback can do the same and has the ability to create Computer Objects during the Enrollment on your behalf. For this functionality configure the following settings: 

Time Zone

Silverback offers several different ways to change the time zone on your managed devices or to define which time zone should be set on all Apple platforms. Firstly, iOS, iPadOS and Apple TV offer the ability for supervised devices to remotely set the time zone with a one-time command. The alternative option is to define a policy where Silverback checks the target and actual status at each device check-in based on the device's reported information and, if there is a discrepancy, resets the time zone to the one defined in the policy. For additional information please refer to Set and configure Time Zones for Apple devices.

App Types

Three different App Types are available for iOS devices:

Assign Apps 

Once Apps are uploaded into the Silverback App Portal Tab, they can be distributed to devices via a Tag they have been associated with.

• Navigate to Apps
• Click Assign More Apps
• Select any applications from the shown Assign Applications page 
• Click Add Selected Apps 

Overview

Already assigned applications are displayed in the Apps section of any Tag with the following columns: 

Change Deployment Options 

By default configurations will be inherit from the App Portal. To customize the settings perform the following steps for each application.

• Click the Edit button in the Manage Config column
• Update Deployment Options
• Click Save

Content Provider

The following content providers can be configured for the M42Mobile App (deprecated) or the Matrix42 Documents application. The Username and Password fields support system variables, so you can dynamically configure them for all users.

Silversync Server Locations

For assigning content with Silversync, there are generally two ways to do this: 

To add content manually:

• Click Add
• Enter the path directly
  • C:\SilversyncContent\users\{UserName}
  • \\NetworkShare\SilversyncFiles\Everybody 

It’s important to note that these paths support system variables. In the example above “{UserName}” will be replaced with that unique user’s username. This is useful for mapping to a home drive network share for example.