Admin Guide Part III: Admin Tab

Android Enterprise

With Android Enterprise, Google offers a technology platform to manage corporate and personal owned devices, settings and applications. In this section, Android Enterprise can be integrated into Silverback and will provide you afterwards information about your registered enterprise. Please review the Android Enterprise Integration Guide for additional information about the benefits and key terms for Android Enterprise.

App Portal

The App portal offers users access to enterprise applications and third-party applications via an web clip icon on iOS, iPadOS and Android devices. Administrators can decide which available App Portal applications will be visible and installable for users on a Tag based level. If the access to public app stores will be disabled for users through restrictions, the App Portal on users devices represents the only available source for applications, also named as your organizations or corporate app store. On Android Enterprise, the App Portal should be used only to provide enterprise applications to corporate owned devices, as the Web Clip approach has shifted to Managed Play.

In this section a customization of the App Portal can be applied to all managed devices with the following options:

Authentication Provider

Please check our Identity Provider Guide for Integration of a SAML2 based Authentication Provider. 

Backup Policy

Administrators have the ability to allow or deny iOS and iPadOS devices to be restored from backup and maintain access to corporate information. If this setting is disabled and when a managed or blocked device is restored from backup, Silverback will detect the restoring and will send a Delete Business Data command to the device which ensures to remove all corporate data. Unmanaged devices are automatically removed after restoring the backup, regardless of this setting. Please refer to Backup Policy for iOS and iPadOS devices for additional information, valid use-cases and other mechanism to prevent backups.

Certificates

This section provides you important information about your Signing Certificate, your Apple Push Notification Service certificate and the Companion Push Notification Service certificate. Ensure to renew your certificates to avoid any service interruptions according to the expiration displayed period.

Cloud Connectors

Cloud Connectors are used for customers that wants to connect a cloud instance from an On-Premise network via HTTPS to use LDAP, Certification Authority or Exchange Protection services. This section displays connected and active Cloud Connectors with additional information like the IP Address, the last connection time and the Client Machine Name.   

Companion

This section offers configuration for the Companion client on devices. Mostly this section is designed to enable the Device Modification Detection, Notifications and the configuration whether users are able to unenroll the device from the application. Please note that the Companion application is not required for the Device Management itself on iOS and iPadOS devices as these platforms are supporting a clientless management with an OS built-in MDM client. For iOS and iPadOS, the Companion is mostly useful for having a jailbreak detection in place. In the past, this section was also used to upload the *.ipa file for the Companion application on iOS and iPadOS. This option has been deprecated as the Companion can be distributed in the meanwhile as an App Store app or an Volume Purchase Program application.

Console Permissions

Console Permissions allows to configure several access and device privacy settings.

Device Enrollment Program

Apple’s Device Enrollment Program can be managed from this section in the Admin Tab. The Device Enrollment Program allows you to have devices enroll into Silverback on first setup, rather than having the user navigate to the Silverback website after the out-of-the-box experience. Please review our Apple Deployment Programs Integration guides for further information.

Device Types

Each type of device can be mapped to a description for easy reading and categorization. By default, known device types are already mapped by Silverback. More device types can be added manually as they become available. If a device enrolls into the system and Silverback does not recognize its model number, the model number will be added to the system with a blank description, allowing the Administrator to define it later. In this case the new device model number will be listed in the Device Types Overview with a description as Unknown. By editing this model number, you can assign an appropriate Device Type and Description. Please refer to Missing Device Models: Overview and Missing Device Models: Add a new model for getting insights about device types and how to add or update new device models. 

Setting	Option	Description
Type	e.g. Samsung Knox	Defines the Operating System platform the the known device.
Model No.	e.g. SM-J530F	Each device models gets his Model number from the Hardware Vendor. In our example the Galaxy J5 could have more then 1 Model No. due to Market or region specific changes.
Description	e.g. Galaxy J5	The description will be shown in Devices area as the "Model" to identify Device Names.
Edit		Edit an existing device type mapping by clicking on the edit button.
Remove		Remove a device type mapping by clicking on the remove button.

Exchange Protection

Thi section represents the configuration for the Exchange Protection Integration.

Email Templates

Email Templates section lets you modify the emails that are sent to users and administrators, and also modify the SMS text that will be sent to end users. Every email generated by Silverback is available in the list. By clicking on Edit, you can customize what the email templates contain. This includes adding images, modifying the text and input system variables. Please refer to Customize Email and SMS Templates for additional information.

Hardware Authentication

Hardware authentication is a part of access control, which ensures that only pre-authorized devices are allowed to become a managed device, e.g. only corporate owned devices that are issued and are fixed assets of your organization. During the enrollment process, Silverback will verify the serial number and/or IMEI of the device against the pre-authorized list and o only known devices will get to the managed status. Unknown devices will remain as blocked. Within this section, you define the list of devices that are allowed to be fully managed in Silverback. To enforce the Hardware Authentication compliance, you need to configure the Lockdown Policy Enforce Hardware Authentication within an Tag that will be applied to devices during or after the enrollment. Please refer to Allow only pre-authorized devices to become managed for adding your devices into the Hardware Authentication. Additionally, you can use the Hardware Authentication to predefine the device ownership, a label, and a visibility flag for each device. 

Detail	Example	Description
Id	e.g. 1	Database ID for the item.
Serial Number	e.g. F17M9VN8FFG8	Serial number of the device.
IMEI	e.g. 35303609258938 8	IMEI number of the device.
Username	e.g. tim.tober@imagoverum.com	Displays the associated user to this device when it is enrolled.
Ownership	Corporate Personal	Displays the pre-defined ownership for this device and will overwrite whatever end users are choosing from Self Service Portal.
Device Name	e.g. Imagoverum-iPad-001	Displays the pre-assigned device name.
Label	e.g. Marketing	Displays the currently associated Label.
Visibility Flag	e.g. Executive Board	Displays the currently associated Visibility Flag.
Edit		Edit the selected device id.
Remove		Removes the selected device id.

Licenses

The Silverback License information is important as it will display you how many devices are enrolled into Silverback and how many licenses are remaining. It will also display how many Silversync licenses have been consumed and when your Maintenance Period will expire.

Lockdown Interval

Lockdown Interval will determine how often Silverback asks each device that is enrolled to perform a Check in to ensure it is still complying with corporate policy. Silverback will automatically stagger these calls out, so that not all devices are asked to check in at the same time, so keep this in mind if you are seeing some delay between different devices. If the device is unable to connect to the Internet, or communicate with Silverback or Cloud Messaging Services (Apple & Android) then the device isn't able to check in – but should do so as soon as it is introduced to a connection where these services are available. Take as well into consideration that the Check In process may have an impact on device battery and data consumption, so set these to sometime sensible.

Allow Automated Unblocking: Allows the system to automatically unblock a device if it no longer violates policy. By default, unblocking requires Admin intervention. By configuring this, if the device checks in and the system detects that a blocking policy is no longer violated, the user will be unblocked automatically, with one exception; admin initiated blocked. These still require the Administrator to manually unblock the device.

Logs

Administrators have the ability to export the error logs from Silverback. These logs could contain either any error messages generated by Silverback or any Action Audit details performed by Administrators and Help Desk users. Administrators can filter the results based on date, using the Start Date and End Date parameters. Simply select the date range and the log generated will return the information within that date range.

MDM Settings

This section contains settings that are specific for certain platforms. As of today, you can configure specific support information that are present under the MDM profile on Windows 10 and Windows 11 devices and you can configure the default lock PIN for policy actions on macOS devices.

Microsoft Entra ID

Connects your Microsoft Entra ID to Silverback to unleash additional Management Options for Windows Autopilot,  Microsoft Entra join, and App Protection Policies.

Pending Commands

Pending commands section will let you enable Managed App Feedback Collection for iOS and iPadOS devices, display all outstanding send commands to iOS, iPadOS, tvOS, macOS, Android, Samsung Knox and display concurrency statistics (if enabled). 

Self Service Portal

End users interface with Silverback through the Self-service portal. The self-service portal can be customized to provide a recognizable look and feel for end users. With the Require Policy Agreement setting enabled the user must agree to a Corporate Policy before they are able to begin the enrolment process. Enabling this policy will change the layout of the Self Service Portal to include an agreement checkbox with an additional, customizable text that is displayed under the Self Service Portal Window. Please refer to our Getting Started Guide Company Branding for additional information.

Silversync

On a high level this sections lets you add, configure, enable and disable Silversync Servers for Silverback. Silversync is the Mobile Content Management Solution of Silverback and lets users remotely gain access to internal files. Please refer to the Silversync Installation and Configuration Guide for additional information. The iOS Application tab lets you define applications for iOS to gain access to internal files. These will be prefilled from Matrix42 and in usual cases you will not have to configure something additional here. 

User Management

The User Management section provides Administrators an overview of all existing accounts and their corresponding roles. New Users can be created, visibility flags can be set and API Tokens can be generated. Under the  Active Directory tab Administrators have the ability to define LDAP Groups, so that all members of this group are able to login as an administrative user with their specific role into the Management Console.  Please refer to Create a new System User for additional information.

Setting	Options	Description
ID	e.g. 1	Displays the ID of the system user.
Username	e.g. admin	Display the username of the system user.
Roles	e.g. Administrator	Displays the specific role set for the system user.
Email	e.g. admin@imagoverum.com	Displays the corresponding email address set for the system user.
Time Zone	e.g. (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna	Displays the configured time zone for the system user.
Edit		Use the button to edit the corresponding user and details.
Remove		Removes the corresponding system user.

Volume Purchase Program

Apple’s Volume Purchase Program program is a service that Apple provides, where purchased applications and licenses through the Apple Business or Apple School Manager can be dynamically assigned and revoked to users and/or devices. Silverback handles the assignment (invitations) of users and devices to the Volume Purchase Program automatically when users enroll devices into the system. Purchased applications and licenses are retrieved and synchronized with Apple and applications will be automatically populated into the App Portal, to be ready to get assigned into Tags. Licenses are assigned to users or devices when Volume Purchase Program applications are present in a Tag that has been assigned to a device and licenses will be revoked when either the application or the device is unassigned from a previously assigned Tag. For troubleshooting purposes, a detailed logging can be enabled and reviewed under the general Log information. For integration of Volume Purchase Program please refer to: Apple Deployment Programs Integration Guide.