UEMB360: Ivanti MDM: Similarities and Differences Managing iOS, macOS, Android and Windows 10

Ivanti MDM: Similarities and Differences Managing iOS, macOS, Android and Windows 10 via MDM
Plinio Pimentel
Jason Forsgren

2. UEMB360 -Ivanti MDM: Similarities and
Differences Managing iOS, macOS,
Android and Windows 10 via MDM
Plinio Pimentel and Jason Forsgren

3. Agenda
Enrollment1
Profiles2
Applications3
Dual Managed 4
Demo5

4. §Enrollment

5. Enrollment
Workflow1
DNS Configuration2
General Configuration3

6. Workflow
Mobile Devices
CSA
Firewall
Windows Devices
(enrollment)
Console
Core
APNS /FCM (GCM) / WINS
DNS

7. DNS configuration
§DNS entry to redirect to CSA
§Allows enrollment without having to type the CSA domain name
§Only available for iOS, MAC and Android enrollment
§Windows DNS mappings
§Allows enrollment in environments where there are redirections
§E.g. Office365, Federated Authentication
§Trick the Windows Enroller to go where we want

8. DNS text string
§Apple (iOS / Mac)
§iOS-enroll=https://[CSA URL]/rtc/[CORE NAME]/MDM/api/v1/IosEnroll
§Android
§Android-enroll=https://[CSA URL]/rtc/[CORE NAME]/MDM/api/v1/AndroidEnroll
§Windows
§Add a (CNAME) to use e-mail to resolve to a different Domain

10. Configuration
§DNS Text
§APNS, FCM(GCM), WINS
§Certificate from apnsportal.landesk.com (License credentials)
§FCM requires Google credentials
§WINS requires a Microsoft developer account (small fee)
§CSA selection

13. Domain mappings
§Used with Windows enrollment only
§Required since we use the native Windows Enroller

14. *Note: If DNS is not available, the server address is presented and you only need to type:
https://[CSA URL]/Core Name]

15. §Profiles

16. Profiles
Entities1
Inventory2

17. Profile entities
§Agent behaviors
§Compliance
§Connectivity
§Exchange/Office365
§Security
ScheduledTask
AgentBehaviors
Profilesand
Certificates

18. Entities cont.
ScheduledTask
AgentBehaviors
Profilesand
Certificates
Last scheduled task wins
You can have default behaviors
Agent behaviors can have more
than one profile, and profiles can
be enable or disabled.

19. Inventory
§Currently, reporting agent behaviors and scheduled tasks
§With the current implementation there are differences on how profiles
are applied.
§E.g. Apple most restrictive wins, and Wi-Fi will not be yanked if connected
§Compliance behaviors have no “Default” because they have restrictions
inside of them, like only apply if the device matches some criteria

21. §Applications

22. Applications
macOS / iOS1
Android2

23. iOS and macOS
§Apple Volume Purchase Program
§Purchase bulk apps from app store
§Add bulk token to Core Server
§Free apps, Links and Documents
§Manifest or Custom Apps

25. Android
§Distribution of free apps
§Distribution of links an documents
§Distribution of Manifests or Custom Apps
§Behavior dependent on the Agent
§Android for Enterprise Agent
§Profile owner mode (BYOD)
§Device owner mode (Corporate owns the device)
§Android Agent
§Regular management (Mingle data)

27. §Dual Managed

28. Dual Managed
Why/Scenarios1
What to watch for2

29. Why and when should I use it?
§macOS want to distribute VPP apps
§Windows wants to configure Wi-Fi / Email settings but still needs
full management
§The device was migrated from MDM to Full Management

30. What to watch for?
§macOS
§They will always share Device ID (Hardware based)
§SYNC Scan will temporarily override the agent scan

31. What to watch for?
§Windows
§If the Device was had an agent and then enrolled in MDM
§It will use current duplicate detection logic but it may take a couple
scans
§MDM Sync scan will override temporarily the full scan
§Both can co-exists

32. §Sneak Preview

33. Some of what is coming to MDM
§Group enrollment
§iOS Profile Configurations
§macOSProfile Configurations
§Applied Profiles(agent behaviors) shown in Inventory
§“Moving more into a “State Management”
§Master Configuration and Applications
§Windows 10 Enhancements
§MDM Software Distribution
§Software inventory

34. §Demo

35. Thank you