The Profiles section of Workspace helps you to restrict the Web access of the user’s device by black listing URLs, black listing certain URLs of a website irrespective of the domain, blacklisting or whitelisting keywords. If any keyword or URL is blacklisted, it will not be accessible through the Workspace browser. But if any keyword or URL is whitelisted, it will be accessible through the custom browser.
| Note: |
|---|
| For iOS devices, you can only whitelist or blacklist the websites or use auto filter. |
Advanced Search for Workspace Profiles
This search option allows you to perform an advanced search for different Workspace profiles. To search profiles, follow these steps:
- Log on to the Seqrite EMM console and in the left pane, select Workspace > Profiles.
- On the Workspace Profile page, click Advanced Search.
-
From the Select Created By list, select the desired creator name and click Search.
The search result gets displayed.
Take an action for Workspace Profiles
The Take Action list appears on the profiles list page when you select single or multiple profiles. The Take Action list shows the following option:
-
Delete: Helps you to delete single or multiple selected Workspace profiles.
Note: You cannot delete a Workspace profile which has a group assigned to it. - Select the required option from the list and click Submit.
Adding a Workspace Profile
This section helps you to create a new Workspace profile on the devices where you can configure the Web/App access policy. You can enable the device users access certain URLs on the Workspace app browser or block them as required. You can apply Workspace Profile Restrictions and have Application Management in Work Profile.
To create Workspace profile, follow these steps:
- Log on to the Seqrite EMM console and in the left pane, select Workspace > Profiles.
- On the Create Workspace Profile page, click Add Workspace Profile.
- Write the Profile Name and add a description in the text field and click Next.
-
In the Website filtering section, enter the keyword or URL to filter the Web access, and click Add. Click Next.
The keyword or the URL entered is added under the Blacklisted URLs/Keywords section.
- To remove the black listed URL or keyword from the list, click the multiplication sign.
- To whitelist all the black listed URL or keywords, click Whitelist All.
- To block access to all URLs except the ones you allowed in whitelist, select the check box.
-
In the Workspace Profile Restrictions section, enable or disable the restriction policy and then apply the following restrictions. Click Next.
- Allow Screen Capture in Work Profile
- Allow Copy/Paste from other profiles
- Allow Camera in Work Profile
- Allow App installation from unknown sources
- Allow App Installation in Work Profile
- Allow App Un-installation in Work Profile
- Enable App Control in Work Profile
- Enable Password Protection in WorkProfile
-
In the Workspace App Management section, set the delivery method on how the apps will be shared such as On Demand or Auto.
You can push corporate-approved apps in Work Profile by selecting Apps from App store. If you need to push an app in Work Profile that is not available in the App Store, you can add a new app in the App Store.
- Click Save.
Workspace Profile Restrictions
Workspace Profile Restrictions include all the restrictions that can be applied to Workspace.
| Sr. No. | Policy | Description |
|---|---|---|
| 1 | Allow Screen Capture in WorkProfile | Allows you to capture screenshots in WorkProfile. |
| 2 | Allow Copy/Paste from other profiles | Allows you to copy/paste from other profiles to WorkProfile. |
| 3 | Allow Camera in WorkProfile | Allows camera usage in WorkProfile. |
| 4 | Allow App installation from unknown sources | Allows you to install apps from unknown sources. |
| 5 | Allow App Installation in WorkProfile | Allows you to install apps in WorkProfile. |
| 6 | Allow App Un-installation in WorkProfile | Allows you to uninstall apps from WorkProfile. |
| 7 | Enable App Control in WorkProfile | Allows controlling of apps in WorkProfile. |
| 8 | Enable Password Protection in WorkProfile | Implements password protection to WorkProfile. If password protection is implemented, you can password-protect WorkProfile. |
Workspace App Management
In this section, you can ship the apps to the device either on demand or automatically. You can add the apps from App Store and push the apps to the devices or even suggest other apps to the device users.
Work Profile App Management
Adding Apps to Work Profile
- Login to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click Work Profile App Management.
- Click Add Apps. The Android Management Apps dialog is displayed. You can also add custom .apk through the Private Apps option.
- Select the app and click Select. for e.g. Outlook. The App permission dialog is displayed.
- On the App Permissions dialog, select Install Silently if you do not want any user intervention and app to be installed automatically on device. If the Install Silently option is not selected, the app is just downloaded on the enrolled device and user has to install it manually.
- Click Ok.
- Click Save. The app is downloaded and installed on the enrolled device.
Uninstalling/Removing apps
- Logon to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click Work Profile App Management.
- In the Install Apps section, select the app that you want to remove. The Remove button is displayed.
- Click Remove.
- Click Ok on the confirmation box. The App is removed from the device.
- You can also go to the Uninstall Apps, click Add App. Select and add the app to the Uninstall List.
- Save the configuration. The app will be removed from the Work Profile.
Note: If admin adds any app in uninstall list, then this app will not be visible in PlayStore even if PlayStore mode policy is on.
iOS Work Profile App Management
Adding Apps to iOS Work Profile
- Login to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click iOS Work Profile App Management.
- Click Add Apps. Add iOS Apps to Container dialog is displayed. You can also add custom .ipa through the Private Apps option.
- Select the app and click Add Apps.
- Click Save. The app is downloaded and installed on the enrolled device.
Adding New Application to App Store
You can add a new iOS app to the app store. This helps you whenever you want to recommend the app in case the app is not present in the app store.
Seqrite Enterprise Mobility Management provides the following options to add apps to the App store:
- iTune Store
- Enterprise App for iOS
Adding Apps Using iTunes Store
- Login to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click iOS Work Profile App Management.
- Click Click here.
- Click iTune Store.
- Enter iTunes Store URL of the app in the given text box. The URL format must be as per the given example in the dialog box.
- Click Add.
Adding Enterprise App for iOS
- Login to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click iOS Work Profile App Management.
- Click Click here.
- Click Enterprise App for iOS.
- Enter App Name, Package Id, Version Name, Version Code, and custom IPA
- Select the .ipa file that you want to add to the app store.
- Click Upload.
Note: File with only .ipa extension is allowed to upload.
Restrictions on iOS Managed Apps
There are few restrictions that can be applied to iOS managed apps.
| Sr. No. | Restriction | Description |
|---|---|---|
| 1 | Allow data to export from Managed to unmanaged | Allows you to restrict a user’s personal sources and accounts from opening documents in your organisation’s managed destinations. |
| 2 | Allow data to import from unmanaged to Managed | Allows you to prevent an organisation’s managed sources and accounts from opening documents in a user’s personal destinations. |
| 3 | Allow unmanaged apps to read managed contacts | Allows unmanaged app apps to read the contact of the managed app |
| 4 | Block Sharing Managed Document using AirDrop | Allows you to restrict user from sharing managed document with other nearby iOS device using AirDrop |
| 5 | Allow Remove of managed apps on MDM Removal | Allows you to restrict user from removing any app from the managed apps. |
| 6 | Restrict Apps uninstallation | Allows you to restrict the user from uninstalling any app |
| 7 | Restrict Data Backup to iTunes | Allows you to restrict user from backing up data to the iTunes |
| 8 | Allow Managed apps cloud sync | Allows user to sync device data with iCloud. |
Personal Space App Management
In this section, you can ship the apps to the device either on demand or automatically. You can add the apps from App Store and push the apps to the devices or even suggest other apps to the device users.
Note: Apps can be silently installed in the workspace but not in the personal space of the device.
Adding Apps to Personal Space
- Login to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click Personal Space App Management.
- Click Add Apps.The Android Management Apps dialog is displayed. You can also add custom .apk through the Private Apps option.
. - Select the app and click Select. for e.g. Outlook. The App permission dialog is displayed.
- Click Save. The app is downloaded and installed on the enrolled device.
Uninstalling/Removing apps
User can not install app added in uninstall app list in the personal space. If the app is already present/installed before, it will be removed from personal space.
To uninstall the app from personal space, follow these steps:
- Logon to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit.
- On the Workspace Profiles Details page, click Personal Space App Management.
- In the Install Apps section, select the app that you want to remove. The Remove button is displayed.
- Click Remove.
- Click Ok on the confirmation box. The App is removed from the device.
- You can also go to the Uninstall Apps, click Add App. Select and add the app to the Uninstall List.
- Save the configuration. The app will be removed from the personal space.
Note: If admin adds any app in uninstall list, then this app will not be visible in PlayStore even if PlayStore mode policy is on.
Edit Work Profile Restrictions
Managing Policies
- Logon to Seqrite EMM console using your credentials.
- Navigate to Workspace > Profiles > Edit Work Profile Restrictions.
- Configure the policies under the sections as required.
- Click Save and Publish. The policies are pushed to the enrolled devices.
Android Management API (AMA) policy options
Note: You need to configure normal policies before configuring AMA policies.
Work Profile Policies
| Section | Description |
|---|---|
| All | Lists all the AMA policies available in Seqrite EMM. |
| Password Policy | Lists the policies related to the password criteria. You can turn on the policies as per your requirement. |
| Work Profile Functionality | List the policies for Work Profile Functionality |
| Policy Compliance Enforcement | Lists the policies for company compliance |
All the policy restrictions are applied at the Work Profile level only.
Password Policy
This policy applies a screen lock and sets the password on the device. Different password types are specified. After applying this policy on the device, the user has to set the password as per the type of the applied password policy. If the device user does not apply the policy applied by the admin, the device will be shown as a non-compliant device.
Password Type
This policy applies a screen lock and sets the password on the device. Different password types are specified. After applying this policy on the device, the user has to set the password as per the type of the applied password policy. If the device user does not apply the policy applied by the admin, the device will be shown as a non-compliant device.
The following are the available password policy options that you can set for the device user:
- PIN/Password: Set password with numbers for PIN or a combination of numbers, letters, and symbols.
- Alphabetic: Set password with at least one letter and a combination of numbers, letters, and symbols.
- Alphanumeric: Set password with at least one number and a combination of numbers, letters, and symbols.
- Custom: Set password as configured in the policy.
Note: If admin selects a higher password criterion and then device user cannot set a lower password as device has higher password criteria.
If the user has set a password to device, then even if Admin unchecks the password policy, password will not be removed until work profile is uninstalled.
Password Minimum Length
To set the length of the password, turn on the Password Minimum Length policy. This policy is dependent on the Password type policy. After applying this policy on the device, the user must set the password as per the recommended password length.
- If the password type is PIN/Password, then the password length must be between 4 to 16.
- If the password type is Alphabetic, then the password length must be in between 8 to 16.
- If the password type is Alphanumeric, then the password length must be in between 8 to 16.
- If the password type is Custom, then the password length must be between 8 to 16.
Note: The user must apply settings as per the applied policy. Otherwise, the device will be shown as Non-compliant device.
Password Age
To set the expiry age for the password, turn on the Password Age policy and then select the expiry age for the password such as 15 Days, 30 Days, 45 Days, and 90 Days.
This policy is dependent on the Password type policy. After the specified time expires, the user must reset a new password. Otherwise, the device will be shown as a non-compliant device.
Maximum Time To Lock
To lock the device automatically after a preset idle time, turn on the Maximum Time To Lock policy.
This policy is dependent on the Password type policy. After applying this policy on the device, if the device screen remains idle for the selected time, the device will be automatically locked. The time can be set to 1 min, 2 mins, 5 mins, 10 mins, and 15 mins.
Password History
To maintain a history of old passwords and to restrict the user from using the old passwords, turn on the Password History policy.
After applying this policy, the device saves the selected number of old passwords given in the list. You can save up to ten old passwords. The user will not be able to set a password that is already saved in the history. A value of 0 indicates that there is no restriction.
USB Data Access
To restrict the files/data transferred via USB turn on this policy and select the required option.
- If the User Data Access set to Unspecified then nothing is specified yet.
- If the User Data Access set to Allow USB Data Transfer then user can transfer the data through USB.
- If the User Data Access set to Disallow USB Data Transfer then user can not transfer the data through USB.
- If the User Data Access set to Disallow USB file Transfer then user can not transfer the file through USB.
Configure Wifi
To allow or restrict the user to configure the wifi turn on this policy and select the required option.
- If the Config Wifi set to Allow Config Wifi then user can not configure the wifi.
- If the Config Wifi set to Disallow Add Config Wifi then user can not edit the wifi configuration.
- If the Config Wifi set to Disallow Config Wifi then the user can not configure the wifi.
Work Profile Functionality
Camera Access
To allow or restrict camera usage, turn on the Camera Access policy and select the appropriate option as required.
- If the camera access is set to User Choice, then the user can access the camera.
- If the camera access is set to Disabled, then the camera access is blocked for the user.
- If the camera access is set to Enforced, then the user can access the camera.
Unknown sources installation
To control the installation from unknown sources, turn on the Unknown sources installation policy and select the required option.
-
If the option is set to Allow untrusted app installation in personal profile, then installation from unknown sources is allowed on the personal profile.
Note: Unknown source installation in work profile is not allowed.
Block Screen Capture
To restrict the user from taking screenshot on the device, turn on the Block Screen Capture policy.
Play Protect App Verification
To control the app verification process, turn on the Play Protect App Verification policy and select from the following required option.
- If the option is set to Allows the user to choose whether to enable app verification, then user can opt for app verification.
- If the option is set to Force-enables app verification, then the app verification is mandatory.
Block Accounts Modification
To restrict Google account additions to the device, turn on Block Accounts Modification. If enabled, the user cannot add another Google account to PlayStore.
Cross Profile Data Sharing
- If Cross Profile Data Sharing disallowed is turned on, data cannot be shared from personal to work profile and from work profile to personal.
- If Data Sharing Work to Personal disallowed is turned on, data sharing from work profile to personal is not allowed and personal to work profile data sharing is allowed.
- If Cross Profile Data Sharing allowed is turned on, data can be shared from personal to work profile and from work profile to personal.
Cross Profile Copy Paste
- If Allowed option is turned on, you can copy/paste from work profile to personal and personal to work profile.
- If Disallowed option is turned on, you cannot copy/paste from work profile to personal or personal to work profile.
Show Contact in Personal Profile
- If Disallowed option is turned on, work profile contacts are not visible
- If Allowed option is turned on, work profile contacts are visible.
Play Store Mode
- If Play Store Mode option is turned On, Play Store apps are displayed.
- If Play Store Mode option is turned Off, only pushed apps are displayed.
Block Printing
To restrict the data printing from work profile, turn on this policy.
Camera disabled
To disable the camera of the device, turn on this policy.
Max Days With Work Off
To set the number of days to pause the user’s work, profile turn on this policy.
Note: Minimum number of days are 3 days.
Installed App Disabled
To disable the app installation in work profile, turn on this policy.
Mount Physical Media Disabled
To disable the mounting of external physical media, turn on this policy.
Uninstall Apps Disable
To disable the app uninstallation from work, profile turn on this policy.
Outgoing Calls Disabled
To disable the outgoing call from work profile, turn on this policy.
Policy Compliance Enforcement
Block Usage of Non-Compliance Devices After (days)
To block the devices automatically that do not comply with the policies after the specified days, turn on Block Usage of Non-Compliance Devices After (days) policy.
Wipe Non-Compliance Devices After (days)
This is a dependent policy. The Work profile will be wiped out automatically from the non compliance devices.
Editing Workspace Profile
You can edit a Workspace profile and apply it to the devices.
Whenever you modify a profile, a new version of the configuration is created.
To edit a profile, see Adding a Workspace Profile.