Contents
- Configuration and management
- Control
- Protection
- Configuring anti-malware protection on Android devices
- Protecting Android devices on the internet
- Protection of data on a stolen or lost device
- Configuring the device unlock password strength
- Configuring a virtual private network (VPN)
- Configuring Firewall on Android devices (only Samsung)
- Protecting Kaspersky Endpoint Security for Android against removal
- Detecting hacked devices
- Configuring a global HTTP proxy on iOS MDM devices
- Adding security certificates to iOS MDM devices
- Adding a SCEP profile to iOS MDM devices
- Restricting SD card usage (only Samsung)
- Management of mobile devices
- Managing Android devices
- Managing iOS MDM devices
- Adding a configuration profile
- Installing a configuration profile on a device
- Removing a configuration profile from a device
- Configuring managed apps
- Installing an app on a mobile device
- Removing an app from a device
- Configuring roaming on an iOS MDM mobile device
- Viewing information about an iOS MDM device
- Disconnecting an iOS MDM device from management
- Configuring kiosk mode for iOS MDM devices
- Management of mobile device settings
- Configuring connection to a Wi-Fi network
- Configuring email
- Configuring protection levels in Kaspersky Security Center
- Managing app configurations
- Managing app permissions
- Creating a report on installed mobile apps
- Installing root certificates on Android devices
- Configuring notifications for Kaspersky Endpoint Security for Android
- Connecting iOS MDM devices to AirPlay
- Connecting iOS MDM devices to AirPrint
- Configuring the Access Point Name (APN)
- Corporate container
- Adding an LDAP account
- Adding a contacts account
- Adding a calendar account
- Configuring a calendar subscription
- Configuring SSO
- Managing Web Clips
- Setting a wallpaper
- Adding fonts
- Working with commands for mobile devices
Configuration and management
This section is intended for specialists who administer Kaspersky Secure Mobility Management, as well as for specialists who provide technical support to organizations that use Kaspersky Secure Mobility Management.
Control
This section contains information about how to remotely monitor mobile devices in the Kaspersky Security Center Web Console.
Configuring restrictions
This section provides instructions on how to configure user access to the features of mobile devices.
Configuring restrictions for personal Android devices
These settings apply to personal devices and devices with a corporate container.
To keep an Android device secure, Kaspersky Mobile Devices Protection and Management lets you configure user access to the following features of mobile devices:
- Wi-Fi
- Camera
- Bluetooth
By default, the user can use Wi-Fi, camera, and Bluetooth on the device without restrictions.
To configure the Wi-Fi, camera, and Bluetooth usage restrictions on the device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Restrictions section.
- On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
- Enable the settings using the Device feature restrictions toggle switch.
- Configure usage of Wi-Fi, camera, and Bluetooth:
- To disable the Wi-Fi module on the user's mobile device, select the Prohibit use of Wi-Fi check box.
On personal devices and devices with a corporate container running Android 10 or later, prohibiting the use of Wi-Fi networks is not supported.
- To disable the camera on the user's mobile device, select the Prohibit use of camera check box.
When camera usage is prohibited, the app displays a notification upon opening and then closes shortly after. On Asus and OnePlus devices, the notification is shown in full screen. The device user can tap the Close button to exit the app.
On devices running Android 11 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If this is the case, you will not be able to restrict use of the camera.
- To disable Bluetooth on the user's mobile device, select the Prohibit use of Bluetooth check box.
On Android 12 or later, the use of Bluetooth can be disabled only if the device user granted the Nearby devices permission. The user can grant this permission during the Initial Configuration Wizard or later.
On personal devices running Android 13 or later, the use of Bluetooth cannot be disabled.
- To disable the Wi-Fi module on the user's mobile device, select the Prohibit use of Wi-Fi check box.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
You can also restrict additional operating system features on corporate devices.
Page topConfiguring iOS MDM device restrictions
To ensure compliance with corporate security requirements, configure restrictions on the operation of iOS MDM devices.
Configuring feature restrictions
To configure iOS MDM device feature restrictions:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Restrictions section.
- On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
- Enable the settings using the Device feature restrictions toggle switch.
- Enable iOS MDM device feature restrictions using toggle switches on corresponding tabs and select the required restrictions.
- Click OK.
- Click Save to save the changes you have made.
As a result, feature restrictions will be configured on the user's mobile device after the policy is applied.
Configuring app restrictions
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Restrictions section.
- On the App restrictions card, click Settings.
The App restrictions window opens.
- Enable the settings using the App restrictions toggle switch.
- Configure iOS MDM device app restrictions.
- Click OK.
- Click Save to save the changes you have made.
As a result, app restrictions will be configured on the user's mobile device after the policy is applied.
Configuring content restrictions
Categories used for content restrictions are determined by Apple. In some cases, when content restrictions are configured, actual results may differ from expected results.
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Restrictions section.
- On the Content restrictions card, click Settings.
The Content restrictions window opens.
- Enable the settings using the Content restrictions toggle switch.
- Configure iOS MDM device content restrictions.
- Click OK.
- Click Save to save the changes you have made.
As a result, content restrictions will be configured on the user's mobile device after the policy is applied.
Page topConfiguring user access to websites
This section contains instructions on how to configure access to websites on Android and iOS devices.
Configuring access to websites on Android devices
You can use Web Control to configure Android device users' access to websites. Web Control supports website filtering by categories defined in the Kaspersky Security Network cloud service. Filtering allows you to restrict user access to certain websites or categories of websites (for example, "Gambling, lotteries, sweepstakes" or "Internet communication"). Web Control is enabled by default.
Web Control on Android devices is supported only in Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser.
On corporate devices, if Kaspersky Endpoint Security for Android is not enabled as an Accessibility feature, Web Control is supported only in Google Chrome and checks only the domain of a website. To allow other browsers (Samsung Internet, Yandex Browser, and HUAWEI Browser) to support Web Control, enable Kaspersky Endpoint Security as an Accessibility feature. This will also let you use the Custom Tabs feature.
If Kaspersky Endpoint Security for Android is not enabled as an Accessibility feature and a proxy is enabled in the Google Chrome settings card, Web Control will not work.
To configure the settings for device users' access to websites:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the Web Control card, click Settings.
The Web Control window opens.
- Select one of the following options:
- If you want the app to restrict user access to websites depending on their content, do the following:
- In the Operating mode drop-down list, in the drop-down list select Prohibit websites in selected categories.
- In the Categories section, create a list of prohibited categories by selecting the check boxes next to the categories of websites to which the app will block access.
- If you want the app to allow or block user access only to specified websites, do the following:
- In the Operating mode drop-down list, select Allow only listed websites or Allow all websites except listed ones.
- Click Add.
- In the window that opens, create a list of websites to which the app will allow or block access, depending on the value selected in the drop-down list. You can add websites by link (full URL, including the protocol, for example,
https://example.com).To make sure that the app allows or blocks access to the specified website in all supported versions of Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser include the same URL twice — once with the HTTP protocol (for example,
http://example.com) and once with the HTTPS protocol (for example, https://example.com).For example:
https://example.com— The main page of the website is either allowed or blocked. This URL can only be accessed through the HTTP protocol.http://example.com— The main page of the website is either allowed or blocked, but only when accessed through the HTTP protocol. Other protocols like HTTPS are not affected.https://example.com/page/index.html— Only the index.html page of the website will be allowed or blocked. The rest of the website is not affected by this entry.
The app also supports regular expressions. When entering the address of an allowed or forbidden website, use the following templates:
https://example\.com/.*— This template blocks or allows all child pages of the website, accessed via the HTTPS protocol (for example,https://example.com/about).https?://example\.com/.*— This template blocks or allows all child pages of the website, accessed via both the HTTP and HTTPS protocols.https?://.*\.example\.com— This template blocks or allows all subdomain pages of the website (for example,https://pictures.example.com).https?://example\.com/[abc]/.*— This template blocks or allows all child pages of the website where the URL path begins with 'a', 'b', or 'c' as the first directory (for example,https://example.com/b/about).https?://\w{3,5}.example\.com/.*— This template blocks or allows all child pages of the website where the subdomain consists of a word with 3 to 5 characters (for example,http://abde.example.com/about).
Use the
https?expression to select both the HTTP and HTTPS protocols. For more details on regular expressions, please refer to the Oracle Technical Support website. - Click Add.
- If you want the app to block user access to all websites, in the Operating mode section, in the drop-down list, select Prohibit all websites.
- If you want the app to restrict user access to websites depending on their content, do the following:
- If you want the app to check the full URL when opening a website in Custom Tabs, select the Check full URL when using Custom Tabs check box.
Custom Tabs is an in-app browser that allows the user to view web pages without having to leave the app and switch to a full web browser version. This option provides better URL recognition and checks URLs against the configured Web Control rules. If the check box is selected, Kaspersky Endpoint Security for Android opens the website in a full version of the browser and checks the whole web address of the website. If the check box is cleared, Kaspersky Endpoint Security for Android checks only the domain of the website in Custom Tabs.
The Custom Tabs feature is supported in Google Chrome, HUAWEI Browser, and Samsung Internet.
- If you want to lift content-based restrictions on user access to websites, disable the settings using the Web Control toggle switch and click Disable.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Managing the website list
You can manage the list of websites with the following buttons:
- Add — Click to add a website to the list by entering a URL or regular expression.
- Upload — Click to add multiple websites to the list by specifying a TXT file that contains the required URLs or regular expressions. The file must be encoded in UTF-8. URLs or regular expressions in the file must be separated by semicolons or line breaks.
- Edit — Click to change the address of a website.
- Delete — Click to remove one or more websites from the list.
Configuring access to websites on iOS MDM devices
These settings apply to supervised devices.
Configure Web Control settings to control access to websites for iOS MDM device users. Web Control manages users' access to websites based on lists of allowed and forbidden websites. Web Control also lets you add website bookmarks on the bookmark panel in Safari.
By default, access to websites is not restricted.
If a URL is redirected to a different website, Web Control checks only the redirect target.
To configure settings for device users' access to websites:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Security controls section.
- On the Web Control card, click Settings.
The Web Control window opens.
- Enable the settings using the Web Control toggle switch.
- In the Operating mode drop-down list do one of the following:
- If you want to create a list of allowed websites, select Allow only listed websites.
- If you want to create a list of forbidden websites, select Allow all websites except listed ones.
- Do one of the following:
- If you want to add websites manually:
- Click Add:
- Add websites to which the app will allow or block access, depending on the value selected in the drop-down list.
The website address should begin with
http://orhttps://. Kaspersky Mobile Devices Protection and Management allows or blocks access to all websites in the domain. For example, if you addhttp://www.example.comto the list of allowed websites, access is allowedhttp://pictures.example.comandhttp://example.com/movies.If you want to add an allowed website to bookmarks in Safari on mobile devices, select the Add to bookmarks on device check box below the website address.
- Click Add.
- If you want to upload a TXT file with a list of websites, click Upload.
The TXT file must be saved with the UTF-8 encoding and LF or CR+RF line breaks.
- If you want to add websites manually:
- Click OK.
- Click Save to save the changes you have made.
As a result, once the policy is applied, Web Control will be configured on the mobile devices.
Page topCompliance Control
This section contains instructions on how to monitor the compliance of devices with corporate requirements and configure compliance control rules.
Compliance Control of Android devices
You can control Android devices for compliance with corporate security requirements. Corporate security requirements regulate how the user can work with the device. For example, the real-time protection must be enabled on the device, the anti-malware databases must be up-to-date, and the device password must be sufficiently strong. Compliance Control is based on a list of rules. A compliance rule includes the following components:
- Device check criterion (for example, absence of blocked apps on the device).
- Time period allocated for the user to fix the non-compliance (for example, 24 hours).
- Responses performed on the device if the user does not correct the non-compliance issue within the set time period (for example, lock the device).
If the device is in battery saver mode, Kaspersky Endpoint Security for Android may perform this task later than specified.
To create a rule for checking devices for compliance with a policy:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the Compliance Control card, click Settings.
The Compliance Control window opens.
- Enable the settings using the Compliance Control toggle switch.
- In the When non-compliance is detected section:
- Select the Notify user check box to inform the user that the device does not comply with the policy.
If the check box is cleared, the user is not notified of the non-compliance issue, and the response is performed on the device as soon as the time allocated for fixing the non-compliance expires.
- Select the Notify the administrator through the "Events" section check box to inform the administrator that the device does not comply with the policy.
- Select the Notify user check box to inform the user that the device does not comply with the policy.
- Click Add.
The Add rule wizard starts. This wizard will help you create a set of rules for checking the device compliance with the policy. Navigate through the wizard using the Next and Back buttons.
Step 1. Criterion for non-compliance
Click Add criterion to specify the non-compliance criterion to trigger the rule.
The following criteria are available:
- Real-time protection is disabled
Kaspersky Endpoint Security for Android is not installed or running on the device.
- Anti-malware databases on device are out of date
Anti-malware databases were last updated 3 or more days ago.
- Forbidden apps are installed
The list of apps on the device contains apps that are set as forbidden in the App Control settings of the policy.
- Apps from forbidden categories are installed
The list of apps on the device contains apps from the categories that are set as forbidden in the App Control settings of the policy.
- Not all required apps are installed
The list of apps on the device does not contain an app that is set as required in the App Control settings of the policy.
- Operating system version is outdated
The Android version on the device is outside the allowed range.
For this criterion, specify the minimum and maximum allowed versions of Android in the Minimum version and Maximum version fields. If the maximum allowed version is set to Any, future Android versions supported by Kaspersky Endpoint Security for Android will also be allowed.
- Device has not been synchronized for a long time
The last synchronization of the device with the Administration Server is checked.
For this criterion, specify the maximum period after the last synchronization in the Period without synchronization field.
- Device has been rooted
The device is hacked (root access is gained on the device).
- Unlock password is not compliant with security settings specified in policy
The unlock password on the device is not compliant with the settings defined in the Screen unlock settings card.
- Installed version of Kaspersky Endpoint Security for Android is outdated
Kaspersky Endpoint Security for Android installed on the device is obsolete.
This criterion applies only to an app installed using a Kaspersky Endpoint Security for Android installation package and if the minimum allowed version of Kaspersky Endpoint Security for Android is specified in the App update settings of the policy.
- SIM card usage is not compliant with security requirements
The device SIM card has been replaced or removed compared to the previous check state, or an additional SIM card has been inserted.
For this criterion, select the specific condition that must be monitored:
- The SIM card must not be replaced or removed
- The SIM card must not be replaced or removed; additional SIM cards must not be inserted
- Device location
The device is outside the specified geofence areas.
Specifying the geofence area will result in increased device power consumption.
For this criterion, select the specific condition that must be monitored:
- The device is within a specified geofence (the geofence areas are combined using the OR logical operator).
- The device is outside specified geofences (the geofence areas are combined using the AND logical operator).
To add a geofence area:
- Click Add geofences.
The Add geofences window opens.
- Specify the Geofence name.
- Specify the geofence perimeter by entering a latitude and a longitude for each point.
For each geofence area, you can manually enter from 3 to 100 coordinate pairs (latitude, longitude) as decimal numbers.
A geofence perimeter must not contain intersecting lines.If needed, you can specify more than 3 points by clicking the Add point button.
To delete a point, click the X button.
You can view the specified geofence area in the Yandex.Maps program by clicking View on map.
- Click OK to add the specified geofences.
- Kaspersky Endpoint Security for Android has no access to precise or background location
Kaspersky Endpoint Security for Android is not allowed to access the precise location of the device or use the device location in the background.
Step 2. Responses for non-compliance with security requirements
Add the responses to be performed on the device if the specified non-compliance criterion is detected.
Choose one of the following options:
- Add instant response. The response is applied instantly after the non-compliance criterion is detected.
- Add deferred response. The response is applied after a deferral period that you can specify in the Deferral period field.
The following responses are available:
- Block all apps except system apps
All apps on the device, except system apps, are blocked from starting.
As soon as the non-compliance criterion selected for the rule is no longer detected on the device, the apps are automatically unblocked.
- Lock device
The mobile device is locked. To obtain access to data, you must unlock the device by entering the one-time passcode or using the Unlock device command.
- Wipe corporate data
The corporate data is wiped from the device. The list of wiped data depends on the mode in which the device operates:
- On a personal device, Knox profile and mail certificate are wiped.
- On a corporate device, Knox profile and the certificates installed by Kaspersky Endpoint Security for Android (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
- Additionally, on a device with corporate container, the container (its content, configurations, and restrictions) and the certificates installed in it (mail, VPN, and SCEP profile certificates, except the mobile certificates) are wiped.
- Reset to factory settings
All data is wiped from the device and settings are rolled back to their factory values. After this response is performed, the device will no longer be managed. To connect the device to Kaspersky Security Center, you must reinstall Kaspersky Endpoint Security for Android.
On devices running Android 14 or later, this response is only applicable if the device is operating in corporate device mode.
- Lock corporate container
Corporate container on the device is locked. To obtain access to corporate container, you must unlock it.
The response is only applicable to devices running Android 6 or later.
After the corporate container on a device is locked, the history of the container passwords is cleared. It means that the user can specify one of the recent passwords, regardless of the corporate container password settings.
- Wipe data of all apps
On a corporate device, data of all apps on the device is wiped.
On a device with corporate container, data of all apps in the container is wiped.
As a result, apps are rolled back to their default state.
The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
- Wipe data of a specified app
For this response, you need to specify the package name for the app whose data is to be wiped. How to get the package name of an app
As a result, the app is rolled back to its default state.
The response is only applicable to devices running Android 9 or later in corporate device or device with corporate container operating modes.
- Prohibit safe boot
The user is not allowed to boot the device in safe mode.
The response is only applicable to corporate devices running Android 6 or later.
- Prohibit use of camera
The user is not allowed to use any cameras on the device.
- Prohibit use of Bluetooth
The user is not allowed to turn on and configure Bluetooth settings.
The response is only applicable to personal devices running Android 12 or earlier, corporate devices, or devices with corporate container.
- Prohibit use of Wi-Fi
The user is not allowed to use and configure Wi-Fi settings.
The response is only applicable to personal devices running Android 9 or earlier or corporate devices.
- Prohibit USB debugging features
The user is not allowed to use USB debugging features and developer mode on the device.
The response is only applicable to corporate devices or devices with corporate container.
- Prohibit airplane mode
The user is not allowed to enable airplane mode on the device.
The response is only applicable to corporate devices running Android 9 or later.
- Block all apps except system apps
Click Add rule to finish the Add rule wizard. The new rule and its details appear in the list of the Compliance Control rules. To temporarily disable a rule, use the toggle switch next to the selected rule.
To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and select one of the following actions:
- Wipe corporate data
- Reset to factory settings
On devices running Android 14 or later, this action is only applicable if the device is operating in corporate device mode.
These settings require integration with Microsoft Active Directory.
If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.
Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topCompliance Control of iOS MDM devices
Compliance Control lets you monitor iOS MDM devices for compliance with corporate security requirements and take actions if non-compliance is found. Compliance Control is based on a list of rules. Each rule includes the following components:
- Status (whether the rule is enabled or disabled).
- Non-compliance criteria (for example, absence of the specified apps or the operating system version).
- Responses performed on the device if the user does not correct the non-compliance issue within the set time period (for example, wipe corporate data or send an email message to the user).
To create a rule for checking devices for compliance with a policy:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Security controls section.
- On the Compliance Control card, click Settings.
The Compliance Control window opens.
- Enable the settings using the Compliance Control toggle switch.
- Click Add.
The Add rule wizard starts. This wizard will help you create a set of rules for checking the device compliance with the policy. Navigate through the wizard using the Next and Back buttons.
Step 1. Criterion for non-compliance
Click Add criterion to specify the non-compliance criterion to trigger the rule.
The following criteria are available:
- List of installed apps
The list of apps on the device contains forbidden apps or does not contain required apps.
For this criterion, select a condition (Contains or Does not contain) and specify the Bundle ID of the app. How to get the bundle ID of an app
- Operating system version
The version of the operating system on the device is outside the allowed range.
For this criterion, select a condition (Equal to, Not equal to, Earlier than, Earlier than or equal to, Later than, or Later than or equal to) and specify the iOS version.
Note that the Equal to and Not equal to operators check for a full match of the operating system version with the specified value. For instance, if you specify iOS 15 in the rule, but the device is running iOS 15.2, the Equal to criterion is not met. If you need to specify a range of versions, you can create two criteria and use the Earlier than and Later than operators.
- Supervision status
The supervision status of the device is not the one required.
For this criterion, select the device operating mode (Supervised or Basic control).
- Device type
The device type is not the one required.
For this criterion, select a device type (iPhone or iPad).
- Device model
The device model is not the one required.
For this criterion, select a condition (Equal to or Not equal to) and specify models that will be checked or excluded from the check, respectively.
To specify a model, in the Model identifier field, select the required model from the list or enter a value manually. The list contains mobile device codes and their matching product names. For example, if you want to add all iPhone 14 models, type "iPhone 14". In this case, you can select any of the available models: "iPhone 14", "iPhone 14 Plus", "iPhone 14 Pro", "iPhone 14 Pro Max".
In some cases, the same product name may correspond to several mobile device codes (for example, the "iPhone 7" product name corresponds to two mobile device codes, "iPhone 9.1" and "iPhone 9.3"). Be sure that you select all of the mobile device codes that correspond to the required models.
If you enter a value that is not on the list, nothing will be found. However, you can click Add: "<value>" under the field to add the entered value to the criterion.
If you specify the criteria that contradict each other (for example, Device type is set to iPhone but the list of values of Device model, with the Equal to operator selected, contains an iPad model), an error message is displayed. You cannot save a rule with such criteria.
- Roaming
The device roaming status is not the one required.
For this criterion, select a condition (Device is roaming or Device is not roaming).
- Password on device
A password is not set or not compliant with the settings specified in the Screen unlock settings card.
For this criterion, select a condition (Not set, Set but not compliant, or Set and compliant).
- Free storage on device
The amount of free space on the device is less than the specified threshold.
For this criterion, specify the threshold amount of free space (Less than or equal to), and then select the measurement unit (MB or GB).
- Device is not encrypted
The device is not encrypted.
Data encryption is enabled by default on password-locked iOS devices (Settings > Touch ID / Face ID and Password > Enable Password). Also, the hardware encryption on a device must be set to At block and file level (you can check this setting in the device properties: go to Assets (Devices) → Mobile → Devices, and then select the required device).
- Actions with SIM card
The device SIM card has been replaced or removed compared to the previous check state, or an additional SIM card has been inserted.
For this criterion, select a condition (The SIM card must not be replaced or removed or The SIM card must not be replaced or removed; additional SIM cards must not be inserted).
On eSIM compatible devices, the non-compliance detection cannot be removed by inserting the previously removed eSIM. This is because the device operating system recognizes each added eSIM as a new one. In this case, delete the compliance control rule from the policy.
- Device has not been synchronized for a long time
The last synchronization of the device with iOS MDM Server is checked.
For this criterion, specify the maximum time after the last sync in the Period without synchronization field, and then select the measurement unit (Hours or Days).
We do not recommend that you specify a value less than the value of the Synchronization period (min) setting specified in the iOS MDM Server settings.
Step 2.Responses for non-compliance with security requirements
Add the responses to be performed on the device if the specified non-compliance criterion is detected.
Choose one of the following options:
- Add instant response. The response is applied instantly after the non-compliance criterion is detected.
- Add deferred response. The response is applied after a deferral period that you can specify in the Deferral period field.
Responses are performed during the compliance rule check, which happens every 40 minutes, and persist until the next synchronization with the iOS MDM Server. To prevent repeating responses from a single non-compliance instance, set the Synchronization period (min) value to 30 minutes in the iOS MDM Server settings.
If you specify responses that contradict each other, an error message is displayed. You cannot save such a rule.
When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the response by sending the respective command to the device.
The following responses are available:
- Send a message to the user
The user is informed about the non-compliance by email.
For this response, specify user email addresses in the Email and Alternate email address fields. If necessary, you can also edit the email subject and default text.
Make sure the Email notifications are configured in the Administration Server properties. For detailed information on configuring notifications delivery, refer to the Kaspersky Security Center Help.
- Wipe corporate data
All installed configuration profiles, provisioning profiles, the device management profile, and apps for which the Remove when device management profile is deleted check box has been selected are removed from the device. This response is performed by sending the Wipe corporate data command.
- Modify profile
For this response, specify one of the actions:
- Install profile. The configuration profile is installed on device. This action is performed by sending the Install configuration profile command. For this response, you also need to specify the ID of the profile to be installed.
Before the profile is installed, it must be added to the list of configuration profiles in the Configuration profiles section of the iOS MDM Server settings.
- Delete specified profile. The configuration profile is deleted from the device. This response is performed by sending the Delete configuration profile command. For this action, you also need to specify the ID of the profile to be deleted.
- Delete all profiles. All previously installed configuration profiles are deleted from the device.
When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted configuration profiles one by one, by sending the respective command to the device.
- Install profile. The configuration profile is installed on device. This action is performed by sending the Install configuration profile command. For this response, you also need to specify the ID of the profile to be installed.
- Update operating system
For this response, specify the OS version and one of the actions:
- Download and install. The device operating system is downloaded and installed.
If a non-existent operating system version is specified in the Operating system version criterion, the device will upgrade to the latest downloaded operating system.
- Download only. The device operating system is downloaded.
- Install only. The previously downloaded operating system is installed.
This response is only applicable to supervised devices.
- Download and install. The device operating system is downloaded and installed.
- Modify Bluetooth settings
For this response, specify whether you want to enable or disable Bluetooth on the device.
This response is only applicable to supervised devices.
- Reset to factory settings
All data is deleted from the device and the settings are rolled back to their default values. After this response is performed, the device will no longer be managed. To connect the device to Kaspersky Security Center, you must reinstall the device management profile on it.
- Modify apps
For this response, specify one of the actions:
- Delete specified app. The specified app is removed from the device.
You can delete only a managed app. An app is considered managed if it has been installed through Kaspersky Security Center by executing the Install app command.
When the non-compliance criteria selected for the rule are no longer detected on the device, you can revert the response by sending the respective command to the device.
For this action, specify the Bundle ID of the app to be deleted. How to get the bundle ID of an app
- Delete all apps. All managed apps are deleted from the device.
You can delete only managed apps. An app is considered managed if it has been installed through Kaspersky Security Center by executing the Install app command.
When the non-compliance criteria selected for the rule are no longer detected on the device, you can install the deleted apps one by one, by sending the respective command to the device.
For this action, specify the Bundle ID of the apps to be deleted. How to get the bundle ID of an app
- Delete specified app. The specified app is removed from the device.
- Delete profile of specified type
For this response, specify the Profile type to be deleted from the device (for example, Web Clips or Calendar subscriptions).
As soon as the non-compliance criteria selected for the rule are no longer detected on the device, the deleted profiles are automatically restored.
- Modify roaming settings
For this response, specify whether you want to enable or disable data roaming on the device.
- Send a message to the user
Click Add rule to finish the Add rule wizard. The new rule and its details appear in the list of Compliance Control rules. To temporarily disable a rule, use the toggle switch next to the selected rule.
To enable the automatic wiping of data from devices associated with disabled accounts of Active Directory users, select the Wipe data from devices with disabled Active Directory user accounts check box and choose one of the following actions:
- Wipe corporate data
- Reset to factory settings
These settings require integration with Microsoft Active Directory.
If you use policy profiles, be sure to enable the wipe data option for the entire policy. When a user account is disabled in Active Directory, it is first removed from the Active Directory user group. As a result, the policy profile is no longer applied to this user account, so the data is not wiped from the device.
Click Save to save the changes you have made.
Page topApp Control
This section contains instructions on how to configure user access to apps on a mobile device.
App Control on Android devices
The App Control component lets you manage apps on Android devices and configure use of these apps to keep the devices secure.
You can restrict user activity on a device on which forbidden apps are installed or required apps are not installed (for example, by locking the device). You can impose restrictions using the Compliance Control component. To do so, in the rule settings, you must select the Forbidden apps are installed, Apps from forbidden categories are installed, or Not all required apps are installed criterion.
Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure proper functioning of App Control. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or later disable this service in the device settings. If the user does this, App Control will not run.
On corporate devices, you have extended control over the device. App Control operates without notifying the device user:
- Required apps are installed automatically in the background. To install apps silently, you need to specify a link to the APK file of the required app in the policy settings.
- Forbidden apps can be deleted from the device automatically. To delete apps silently, you need to select the Remove forbidden apps automatically check box in the policy settings.
To configure app startup settings on the mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the App Control card, click Settings.
The App Control window opens.
- Enable the settings using the App Control toggle switch.
- Configure the settings on the following tabs:
- If you want to configure general rules of app management, go to the App use tab.
- If you want to set actions to be performed for selected apps, go to the App management tab.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topApp Control on iOS MDM devices
These settings apply to supervised devices.
Kaspersky Security Center lets you manage apps on iOS MDM devices to keep these devices secure. You can create a list of apps allowed to be installed on devices and a list of apps prohibited from being displayed and launched on devices.
To configure the list of apps allowed or prohibited to be installed on devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Security controls section.
- On the App Control card, click Settings.
The App Control window opens.
- Enable the settings using the App Control toggle switch.
- In the Operating mode field, select one of the following options:
- Use all apps except forbidden ones
All apps will be displayed and available to run on the device except the ones from the list.
- Use only allowed apps
This option is selected by default. If you select this option, the user will be able to open only the following apps on the device:
- Apps in the list
- System apps
All other apps will be hidden.
- Use all apps except forbidden ones
- Click Add to add apps to the list.
- In the window that opens, specify the app's bundle ID in the corresponding field. Specify the
com.apple.webappvalue to allow or restrict all Web Clips. How to get the bundle ID of an appIf necessary, you can specify several bundle IDs by clicking the Add bundle ID button.
- Click Save.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, the specified settings for apps are configured on devices.
Page topMobile device protection levels
Mobile device protection levels defined by Kaspersky Security Center
Web Console lets you quickly assess the current protection level of managed mobile devices in the Assets (Devices) → Mobile → Devices section.
A device can have one of the following protection levels: OK, Warning, or Critical.
The protection levels are assigned and sent to Kaspersky Security Center, in accordance with the following requirements:
- One reason for assigning a protection level is detected on the device — the device gets the status displayed in the list of managed devices.
- Multiple reasons for assigning protection levels are detected on the device — Kaspersky Mobile Devices Protection and Management assigns the most critical status.
- No reasons for assigning a protection level are detected on the device — Kaspersky Mobile Devices Protection and Management does not send a status to Kaspersky Security Center, and the status is set as OK.
Protection levels and their meanings
Protection level
Meaning
OKAn administrator's intervention is not required.
WarningEvents have been logged that are related to potential or actual threats to the security of managed devices.
CriticalSerious problems have been encountered. An administrator's intervention is required to solve them.
The administrator's goal is to ensure that the OK protection level exists on all devices.
Mobile device protection levels defined by Kaspersky Mobile Devices Protection and Management
Kaspersky Mobile Devices Protection and Management defines the protection level of mobile devices based on policy settings and then sends the protection levels to Kaspersky Security Center during synchronization. The administrator can change the protection level in the policy, depending on the severity level of the condition (see the Default values, reasons, and conditions for assigning a protection level on Android devices table). In this case, the value set by the administrator overrides the default value defined by Kaspersky Mobile Devices Protection and Management.
Default values, reasons, and conditions for assigning a protection level on Android devices
Condition |
Reason for protection level |
Default value |
|---|---|---|
Real-time protection is not running
|
One of the following reasons:
|
Critical |
Web Protection and Web Control are not running |
One of the following reasons:
|
Warning |
App Control is not running |
The Accessibility permission has not been granted. |
Warning |
Device lock is not available |
One of the following reasons:
|
Warning |
Device location is not available |
One of the following reasons:
|
Warning |
Versions of the Kaspersky Security Network Statement do not match |
The version of the Kaspersky Security Network Statement that the user accepted in the policy and the version of the Kaspersky Security Network Statement on the device do not match. |
Warning |
Versions of the Marketing Statement do not match |
The version of the Statement regarding data processing for marketing purposes that the user accepted in the policy and the version of the Statement regarding data processing for marketing purposes on the device do not match. |
OK |
Software inventory on Android devices
You can take an inventory of apps on Android devices connected to the Administration Server. Kaspersky Endpoint Security for Android receives information about all apps installed on mobile devices. Information obtained while taking inventory is displayed in the device properties in the Events section. In this section, you can view detailed information on each installed app.
To enable software inventory:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the App Control card, click Settings.
The App Control window opens.
- In the Report on installed apps section, select the Send data on installed apps check box.
- If you want to receive data about system apps, select the Send data on built-in apps check box.
- If you want to receive data about service apps, which do not have an interface and cannot be opened by the user, select the Send data on service apps check box.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android sends data to the event log each time an app is installed or removed from the device.
Page topProtection
This section contains information about how to remotely manage protection of mobile devices in the Kaspersky Security Center Web Console.
Configuring anti-malware protection on Android devices
For timely detection of threats, viruses, and other malicious applications, you can configure the settings for real-time protection and automatic malware scans.
Kaspersky Endpoint Security for Android detects the following types of objects:
- Viruses, worms, Trojans, and malicious tools
- Adware
- Legitimate apps that intruders can use to compromise users' devices or data
Anti-Malware has several limitations:
- Due to technical limitations, Kaspersky Endpoint Security for Android cannot scan files with a size of 2 GB or more. During a scan, the app skips such files without notifying you that such files were skipped.
- On devices running Android 11 or later, Kaspersky Endpoint Security for Android can't scan the "Android/data" and "Android/obb" folders and detect malware in them due to technical limitations.
Configuring real-time protection
To configure real-time protection settings for mobile devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Protection section.
- On the Real-time protection card, click Settings.
The Real-time protection window opens.
- Enable the settings using the Real-time protection toggle switch.
If the toggle switch is turned on, device protection is enabled, but can be manually disabled by the user.
If the toggle switch is turned off, device protection is disabled and the user can't enable it.
- In the App scan drop-down list, select the app scan mode:
- Do not scan apps
- Scan only new apps
- Scan all apps and monitor actions with files
- In the Action on threat detection drop-down list, select one of the following options:
- Delete
Detected objects will be automatically deleted. The user is not required to take any additional actions. Prior to deleting an object, Kaspersky Endpoint Security for Android will display a temporary notification about the detection of the object.
- Skip
If detected objects have been skipped, Kaspersky Endpoint Security for Android warns the user about problems in device protection. For each skipped threat, the app provides actions that the user can perform to eliminate the threat. The list of skipped objects may change, for example, if a malicious file is deleted or moved. To receive an up-to-date list of threats, run a full device scan. To ensure reliable protection of your data, eliminate all detected objects.
- Delete and save a backup copy of file in quarantine
- Delete
- To enable additional scanning of new apps before they are started for the first time on the user's device with the help of the Kaspersky Security Network cloud service, select the Additional protection by Kaspersky Security Network check box.
- To block adware and apps that can be exploited by criminals to harm the device or user data, select the Detect adware, autodialers, and legitimate apps that intruders can use to compromise the user's device and data check box.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Configuring automatic malware scans
To configure autorun of malware scans on the mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Protection section.
- On the Scan card, click Settings.
The Scan window opens.
- Enable the settings using the Scan toggle switch.
- In the Action on threat detection list, select one of the following options:
- Delete
Detected objects will be automatically deleted. The user is not required to take any additional actions. Prior to deleting an object, Kaspersky Endpoint Security for Android will display a temporary notification about the detection of the object.
- Skip
If detected objects have been skipped, Kaspersky Endpoint Security for Android warns the user about problems in device protection. For each skipped threat, the app provides actions that the user can perform to eliminate the threat. The list of skipped objects may change, for example, if a malicious file is deleted or moved. To receive an up-to-date list of threats, run a full device scan. To ensure reliable protection of your data, eliminate all detected objects.
- Delete and save a backup copy of file in quarantine
- Ask user
Kaspersky Endpoint Security for Android displays a notification prompting the user to choose the action to take on the detected object: Skip or Delete.
Kaspersky Endpoint Security for Android must be set as an Accessibility feature to ensure the display of notifications on mobile devices running Android 10 or later. Kaspersky Endpoint Security for Android prompts the user to set the app as an Accessibility feature through the Initial Configuration Wizard. The user can skip this step or disable this service in the device settings at a later time. In this case, Kaspersky Endpoint Security for Android displays an Android system window prompting the user to choose the action to take on the detected object: Skip or Delete. To apply an action to multiple objects, you need to open Kaspersky Endpoint Security.
If during a scan Kaspersky Endpoint Security for Android detects malicious apps on users' devices, the actions differ depending on the device management mode.
- Delete
- In the Scheduled scan field, you can configure the settings for automatic launching a full scan of the device file system.
- If you selected a weekly or daily scan, specify the day of the week (for weekly scans) and start time in the Day and Time fields.
If the device is in battery saver mode, the app may perform this task later than specified.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. Kaspersky Endpoint Security for Android scans all files, including the contents of archives.
To keep mobile device protection up to date, configure the anti-malware database update settings.
By default, anti-malware database updates are disabled when the device is roaming. Scheduled updates of anti-malware databases are not performed.
Configuring database updates
To configure settings for anti-malware database updates:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Protection section.
- On the Database update card, click Settings.
The Database update window opens.
- Enable the settings using the Database update toggle switch.
- In the Scheduled database update field, you can configure the settings for automatic anti-malware database updates on the user's device.
- If you selected a weekly or daily database update, specify the day of the week (for weekly database updates) and start time in the Day and Time fields.
If the device is in battery saver mode, the app may perform this task later than specified.
- In the Database update source section, specify the update source from which Kaspersky Endpoint Security for Android receives and installs anti-malware database updates:
- Kaspersky servers
Using a Kaspersky update server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices. To update databases using Kaspersky servers, Kaspersky Endpoint Security for Android transmits data to Kaspersky (for example, the update task run ID). The list of data that is transmitted during database updates is provided in the End User License Agreement.
- Administration Server
Using the repository of Kaspersky Security Center Administration Server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices.
- Other source
Using a third-party server as an update source for downloading the databases of Kaspersky Endpoint Security for Android on users' mobile devices. To start an update, you must enter the address of an HTTP server in the field below (for example,
http://domain.com/).
- Kaspersky servers
- If you want Kaspersky Endpoint Security for Android to download database updates according to the update schedule when the device is roaming, select the Allow database update while roaming check box in the Database update while roaming section.
Even if the check box is cleared, the user can manually start an anti-malware database update when the device is roaming.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topProtecting Android devices on the internet
You can use Web Protection to protect personal data of mobile device users on the internet. Web Protection blocks malicious websites that distribute malicious code, and phishing websites designed to steal your confidential data and gain access to your financial accounts. Web Protection scans websites before you open them using the Kaspersky Security Network cloud service. Web Protection is enabled by default.
In Yandex Browser and Samsung Internet, malicious and phishing websites may remain unblocked. This is because only the website domain is scanned, and if it is trusted, Web Protection can skip a threat.
Web Protection on Android devices is supported only in Google Chrome, HUAWEI Browser, Samsung Internet, and Yandex Browser.
On corporate devices, if Kaspersky Endpoint Security for Android is not enabled as an Accessibility feature, Web Protection is supported only in Google Chrome and checks only the domain of a website. To allow other browsers (Samsung Internet, Yandex Browser, and HUAWEI Browser) to support Web Protection, enable Kaspersky Endpoint Security as an Accessibility feature.
To enable Web Protection:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Protection section.
- On the Web Protection card, enable the settings using the Web Protection toggle switch.
- Click Enable.
If you disable Web Protection, Web Control will also be disabled.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topProtection of data on a stolen or lost device
This section describes how you can configure the unauthorized access protection settings on the device in case it gets lost or stolen.
Sending commands to a lost or stolen mobile device
To protect data on a mobile device that is lost or stolen, you can send special commands.
You can send commands to the following types of managed mobile devices:
- Android devices managed via the Kaspersky Endpoint Security for Android app
- iOS MDM devices
Each device type supports a specific set of commands (see the tables below).
Commands for Android devices
Commands for protecting data on a lost or stolen Android device
Command |
Result |
|
|---|---|---|
Lock device |
The mobile device is locked. To obtain access to data, you must unlock the device using the Unlock device command or a one-time passcode. |
|
Unlock device |
The mobile device is unlocked. After unlocking a device running Android 5 – 6, the screen unlock password is reset to "1234". After unlocking a device running Android 7 or later, the screen unlock password is not changed. |
|
Reset to factory settings |
All data is deleted from the mobile device and the settings are rolled back to their factory values. After this command is executed, the device will not be able to receive or execute subsequent commands. This command is unavailable for personal devices and devices with a corporate container running Android 14 or later. |
|
Wipe corporate data |
Corporate data is wiped from the device. The list of wiped data depends on the mode the device is operating in:
|
|
Locate device |
The mobile device's location coordinates are obtained. To view the device location on a map, go to the Assets (Devices) → Mobile → Devices section. Then choose a device and select Command history → Locate device → Device coordinates → Open Maps. On devices running Android 12 or later, if the user granted the "Use approximate location" permission, the Kaspersky Endpoint Security for Android app first tries to get the precise device location. If this is not successful, the approximate device location is returned only if it was received within the past 30 minutes. Otherwise, the command fails. This command does not work on Android devices if Google Location Accuracy is disabled in the settings. Please be aware that not all Android devices come with this location setting. |
|
Take photos |
The mobile device is locked. Photos are taken using the front camera of the device when somebody attempts to unlock the device. On devices with a pop-up front camera, the photo will be black if the camera is stowed. When attempting to unlock the device, the user automatically consents to having their photo taken on the device. If the permission to use the camera has been revoked, the mobile device displays a notification and prompts to provide the permission. On a mobile device running Android 12 or later, if the permission to use the camera has been revoked via Quick Settings, the notification is not displayed but the taken photo is black. |
|
Sound alarm |
The mobile device sounds an alarm. The alarm is sounded for 5 minutes (or for 1 minute if the device battery is low). |
|
Wipe app data |
The data of a specified app is wiped from the mobile device. For this action, you need to specify the package name for the app whose data is to be deleted. |
|
Wipe data of all apps |
The data of all apps is wiped from the mobile device. On a corporate device, the data of all apps on the device is wiped. |
|
Get location history |
The mobile device's location history for the last 14 days is displayed. To view the device location on a map, go to the Assets (Devices) → Mobile → Devices section. Then choose a device and select Command history → Get location history → View on map. Due to technical limitations on Android devices, the device location may be retrieved less often than specified in the Location tracking settings. |
|
Commands for iOS MDM devices
Commands for protecting data on a lost or stolen iOS MDM device
Command |
Result |
|---|---|
Lock device |
The mobile device is locked. To access data, you must unlock the device. |
Reset unlock password |
The mobile device's screen unlock password is reset, and the user is prompted to set a new password in accordance with policy requirements. |
Reset to factory settings |
All data is deleted from the mobile device and the settings are rolled back to their factory values. After this command is executed, the device will not be able to receive or execute subsequent commands. |
Wipe corporate data |
All installed configuration profiles, provisioning profiles, the iOS MDM profile, and apps for which the Remove when device management profile is deleted check box has been selected are removed from the device. |
Enable Lost Mode (supervised only) |
Lost Mode is enabled on the supervised mobile device, and the device is locked. The device screen shows a message and phone number that you can edit. If you send the Enable Lost Mode command to a supervised iOS MDM device without a SIM card and this device is restarted, the device won't be able to connect to Wi-Fi and receive the Disable Lost Mode command. This is a specific feature of iOS devices. To avoid this issue, you can either send the command only to devices with a SIM card, or insert a SIM card into the locked device to allow it to receive the Disable Lost Mode command over the mobile network. |
Locate device (Lost Mode only) |
The location of the mobile device is obtained. To view the device location on a map, go to the Assets (Devices) → Mobile → Devices section. Then choose a device and select Command history → Locate device → Device coordinates → Open Maps. |
Sound alarm (Lost Mode only) |
A sound is played on the lost mobile device. |
Disable Lost Mode (supervised only) |
Lost Mode is disabled on the mobile device, and the device is unlocked. |
Permissions for executing commands
Special rights and permissions are required for executing Kaspersky Endpoint Security for Android commands. When the Initial Configuration Wizard is running, Kaspersky Endpoint Security for Android prompts the user to grant the application all required rights and permissions. The user can skip these steps or later disable these permissions in the device settings. If this is the case, it will be impossible to execute commands.
On devices running Android 10 or later, the user must grant the "All the time" permission to access the location. On devices running Android 11 or later, the user must also grant the "While using the app" permission to access the camera. Otherwise, Anti-Theft commands will not function. The user will be notified of this limitation and will again be prompted to grant the required level of permissions. If the user selects the "Only this time" option for the camera permission, access is considered granted by the app. We recommend contacting the user directly if the Camera permission is requested again.
For the complete list of available commands, please refer to the Commands for mobile devices section. To learn more about sending commands from Administration Console, please refer to the Sending commands section.
Page topUnlocking a mobile device
You can unlock a mobile device using the following methods:
- Send the mobile device unlock command
- Enter the one-time passcode on the mobile device (only for Android devices)
On certain devices (for example, HUAWEI, Meizu, and Xiaomi), you must manually add Kaspersky Endpoint Security for Android to the list of apps that are started when the operating system starts. If the app is not added to the list, you can unlock the device only by using a one-time passcode. You cannot use commands to unlock the device.
To learn more about sending commands from the list of mobile devices in Web Console, please refer to the Sending commands section.
A one-time device passcode is a secret code for unlocking the mobile device. The passcode is generated by Kaspersky Security Center and is unique for each mobile device. You can change the length of the one-time passcode (4, 8, 12, or 16 digits) in the Anti-Theft settings of the policy.
To unlock a mobile device using a one-time passcode:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- Click the mobile device for which you want to get a one-time passcode.
- Select Applications → Kaspersky Mobile Devices Protection and Management.
The Kaspersky Mobile Devices Protection and Management properties window opens.
- Select the Application settings tab.
The unique passcode for the selected device is shown in the One-time code field of the One-time device passcode section.
- Use any available method (such as email) to communicate the one-time passcode to the user of the locked device.
The user then must enter the received one-time passcode on the screen of the device that is locked by Kaspersky Endpoint Security for Android.
The user's mobile device is unlocked.
After unlocking a device running Android 5 – 6, the screen unlock password is reset to "1234". After unlocking a device running Android 7 or later, the screen unlock password is not changed.
To change the length of the one-time device passcode:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Protection section.
- On the Anti-Theft card, click Settings.
The Anti-Theft window opens.
- Select the length of the one-time device passcode in the corresponding drop-down list. By default, the passcode is 4 digits long.
- If you want to contact the person who finds the mobile device, in the Text displayed on locked device field, enter the text of the message that will be shown on the lock screen.
- Click OK.
- Click Save to save the changes you have made.
The length of the one-time passcode is set to the selected value.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topConfiguring the device unlock password strength
To protect access to a user's mobile device, you should set a device unlock password.
This section contains information about how to configure password protection on Android and iOS devices.
Configuring a strong unlock password for an Android device
To keep an Android device secure, you need to configure the use of a password that the user is prompted to enter when unlocking the device.
You can impose restrictions on the user's activity on the device if the unlock password is weak (for example, by locking the device). You can impose restrictions using the Compliance Control component. To do this, in the scan rule settings, you must select the Unlock password doesn't comply with security requirements criterion.
On certain Samsung devices running Android 7 or later, when the user attempts to configure unsupported methods for unlocking the device (for example, a graphical password), the device may be locked if the following conditions are met: removal protection is enabled for Kaspersky Endpoint Security for Android and strength requirements are set for the screen unlock password. To unlock the device, you must send a special command to the device.
Configuring unlock password settings
To configure the use of an unlock password:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the Screen unlock settings card, click Settings.
The Screen unlock settings window opens.
- Enable the settings using the Screen unlock settings toggle switch, if you want the app to check whether an unlock password has been set.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
If the app detects that no system password has been set on the device, it prompts the user to set one. The password is set according to the parameters defined by the administrator.
- Specify the following options, if required:
- Minimum password length
- Minimum password complexity requirements
- Maximum password lifetime (days)
- Number of days to send a notification before a required password change
- Number of recent passwords that cannot be set as a new password
- Period of inactivity before the screen locks (sec)
- Period after biometric unlock before password must be entered (min)
- Allow biometric unlock methods
- Allow fingerprint unlock
- Allow face unlock
- Allow iris scanning
- Reset to factory settings after failed attempts to enter password
- Maximum number of failed password attempts
- Set new password
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Setting a new unlock password
To set a new password on a user's corporate device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Restrictions section.
- On the New screen unlock password card, click Settings.
The New screen unlock password window opens.
- Enable the settings using the New screen unlock password toggle switch.
- Enter a new password that will be used to unlock the user's mobile device. This password must comply with current screen unlock password settings.
- If you want to edit the current unlock password settings, click the Configure screen unlock settings button.
In the Screen unlock settings window that opens, configure screen unlock password settings, if required.
- Click OK.
If the device is not protected with a password or is running Android 10 or earlier, Kaspersky Endpoint Security for Android sets the password immediately. If the device is protected with the password or is running Android 11 or later, Kaspersky Endpoint Security for Android prompts the user to apply the new password.
- Click Save to save the changes you have made.
The new password is set on user's mobile device. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Setting a PIN code on HUAWEI devices
Some HUAWEI devices display a message about screen unlocking method being too simple.
To set an acceptable PIN code on a HUAWEI device, the user must do the following:
- In the message about the issue, tap the Edit button.
- Enter the current PIN code.
- In the Set new password window, tap the Change unlock method button.
- Select the Custom PIN unlock method.
- Set the new PIN code.
The PIN code must be compliant with policy requirements.
An acceptable PIN code is set on the device.
Page topConfiguring a strong unlock password for an iOS MDM device
These settings apply to supervised devices and devices operating in basic control mode.
To protect iOS MDM device data, configure the unlock password strength settings.
By default, the user can use a simple password. A simple password is a password that contains sequential or repeated characters such as "abcd" or "2222". The user is not required to enter an alphanumeric password that includes special symbols. By default, the password validity period and the number of password entry attempts are not limited.
To configure the unlock password strength settings for an iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Security controls section.
- On the Screen unlock settings card, click Settings.
The Screen unlock settings window opens.
- Enable the settings using the Screen unlock settings toggle switch.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
- Configure the unlock password strength settings:
- To allow the user to use a simple password, select the Allow simple password check box. Even if this check box is cleared, the user can set a password with less than 6 characters.
If only the Allow simple password check box is selected, no password will be requested. To prompt the user to set a password, select both the Allow simple password check box and the Force use of password check box.
- To require use of both letters and numbers in the password, select the Prompt for alphanumeric value check box.
- To require use of a password, select the Force use of password check box. If the check box is cleared, the mobile device can be used without a password.
If the Prompt for alphanumeric value, Minimum password length, or Minimum number of special characters options are enabled, a password is requested even if the Force use of password check box is cleared.
- In the Minimum password length list, select the minimum password length in characters.
- In the Minimum number of special characters list, select the minimum number of special characters in the password (such as "$", "&", "!").
On some iOS MDM devices, if the Minimum number of special characters value is specified and the Allow simple password check box is selected, the device displays information about setting a password of 6 or more characters even though it is possible to set a password of 4 or more characters.
- In the Maximum password lifetime (days) field, specify the period of time in days during which the password will stay current. When this period expires, the iOS MDM Server prompts the user to change the password.
- In the Auto-Lock list, select the amount of time after which Auto-Lock should be enabled on the iOS MDM device. If the mobile device remains idle for this time period, it switches to sleep mode.
On different iOS MDM devices, the actual time of the device's automatic locking may differ from the value that you have specified:
On iPhone devices: if you set Auto-Lock in 10 or 15 minutes, the device will be locked in 5 minutes.
On iPad devices: if you set Auto-Lock in 1 – 4 minutes, the device will be locked in 2 minutes.
For other values the actual time of the device's automatic locking matches the specified time.
- In the Reuse of previous passwords field, specify the number of used passwords (including the current password) that the iOS MDM Server will compare with the new password when the user changes the current password. If the passwords match, the new password is rejected.
- In the Maximum time for unlock without password list, select the amount of time during which the user can unlock the iOS MDM device without entering the password.
- In the Maximum number of failed password attempts, select the number of attempts that the user can make to enter the unlock password on the iOS MDM device.
- To allow the user to use a simple password, select the Allow simple password check box. Even if this check box is cleared, the user can set a password with less than 6 characters.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, the iOS MDM Server checks the strength of the password set on the user's mobile device. If the strength of the device unlock password does not comply with the policy, the user is prompted to change the password.
Page topConfiguring a virtual private network (VPN)
This section contains information on configuring virtual private network (VPN) settings for secure connection to Wi-Fi networks.
Configuring VPN on Android devices (only Samsung)
To securely connect an Android device to the internet and protect data transfer, you can configure VPN (Virtual Private Network) settings.
Configuration of VPN is possible only for Samsung devices running Android 11 or earlier.
The following requirements must be considered when using a virtual private network:
- The app that uses the VPN connection must be allowed in the Firewall settings.
- VPN settings configured in the policy cannot be applied to system apps. The VPN connection for system apps has to be configured manually.
- Some apps that use a VPN connection need to have additional settings configured at first startup. To configure settings, a VPN connection has to be allowed in app settings.
To configure VPN on a user's mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Samsung Knox settings section.
- On the VPN card, click Settings.
The VPN window opens.
- Enable the settings using the VPN toggle switch.
- Specify the following VPN settings:
- Settings in the Network section:
- In the Network name field, enter the name of the VPN tunnel.
- In the Protocol drop-down list, select the VPN connection type:
- IPSec Xauth PSK. A tunneling protocol of the "gateway-to-gateway" type that lets the mobile device user establish a secure connection with the VPN server using the Xauth authentication utility.
- L2TP IPSec PSK. A tunneling protocol of the "gateway-to-gateway" type that lets the mobile device user establish a secure connection with the VPN server via the IKE protocol using a preset key. This protocol is selected by default.
- PPTP. A "point-to-point" tunneling protocol that lets the mobile device user establish a secure connection to the VPN server by creating a special tunnel on a standard unsecured network.
- In the Server address field, enter the network name or IP address of the VPN server.
- Settings in the Protocol settings section:
- In the DNS search domain(s) list, enter the DNS search domain to be automatically added to the DNS server name.
You can specify several DNS search domains, separating them with blank spaces.
- In the DNS server(s) field, enter the full domain name or IP address of the DNS server.
You can specify several DNS servers, separating them with blank spaces.
- In the Routing field, enter the range of network IP addresses with which data is exchanged via the VPN connection.
If a range of IP addresses is not specified in the Routing field, all internet traffic will pass through the VPN connection.
- In the DNS search domain(s) list, enter the DNS search domain to be automatically added to the DNS server name.
- Settings in the Network section:
- Additionally, configure the following settings:
- For the IPSec Xauth PSK and L2TP IPSec PSK protocols:
- In the IPSec shared key field, enter the password for the preset IPSec security key.
- In the IPSec ID field, enter the name of the mobile device user.
- For the L2TP IPSec PSK protocol, specify the password for the L2TP key in the L2TP key field.
- For the PPTP network, select the Use SSL connection check box so that the app will use the MPPE (Microsoft Point-to-Point Encryption) method of data encryption to secure data transmission when the mobile device connects to the VPN server.
- For the IPSec Xauth PSK and L2TP IPSec PSK protocols:
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topConfiguring VPN on iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
To connect an iOS MDM device to a virtual private network (VPN) and protect data while connected to the VPN, configure the VPN connection settings. The IKEv2 and IPSec VPN protocols also let you set up a Per App VPN connection.
To configure a VPN connection on a user's iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the VPN card, click Settings.
The VPN window opens.
- Enable the settings using the VPN toggle switch.
- Click Add.
The Add VPN configuration window opens.
- On the General settings tab, in the Network section, configure the following settings:
- In the Network name field, enter the name of the VPN tunnel.
- In the Protocol drop-down list, select the type of the VPN connection.
- In the Server address field, enter the network name or IP address of the VPN server.
- Configure the settings for the VPN connection according to the selected type of virtual private network.
- If necessary, on the Advanced settings tab, in the Proxy server section, configure the settings of the VPN connection via a proxy server:
- Select the Use a proxy server check box.
- Configure a connection to a proxy server:
- If you want to configure the connection automatically:
- Select Automatic.
- In the PAC file URL field, specify the URL of the proxy PAC file.
- To allow the user to connect the mobile device to a wireless network without using a proxy server when the PAC file cannot be accessed, select the Allow direct connection if PAC file cannot be accessed check box.
- If you want to configure the connection manually:
- Select Manual.
- In the Proxy server address and Proxy server port fields, enter the IP address or DNS name of the proxy server and port number.
- In the User name field, select a macro that will be used as a user name for the connection to the proxy server.
- In the Password field, specify the password for the connection to the proxy server.
- If you want to configure the connection automatically:
- For IKEv2 and IPSec connections, if necessary, set up Per App VPN functionality for supported system apps (Mail, Calendar, Contacts, and Safari).
- Click Add.
The new VPN is displayed in the list.
You can modify or delete VPN in the list using the Edit and Delete buttons at the top of the list.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, the VPN connection will be configured on the user's iOS MDM device.
Page topConfiguring Per App VPN on iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
The Per App VPN functionality allows a device to establish a VPN connection when supported system apps are launched. This functionality is available for IKEv2 and IPSec connections.
The following system apps support Per App VPN connections:
- Calendar
- Contacts
- Safari
- Messages
To enable the Per App VPN functionality:
- Perform the initial setup of the VPN connection.
- On the Advanced settings tab, in the Per App VPN section, select the Enable Per App VPN check box.
- Set up Per App VPN for supported system apps in the corresponding settings of the policy.
To specify the Per App VPN configuration for the Mail app:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Email card, click Settings.
The Email window opens.
- Enable the settings using the Email toggle switch.
- Click Add.
The Add email account window opens.
- Configure a mailbox.
- On the Advanced settings tab, in the Per App VPN section, select the Enable Per App VPN check box.
- Select a configuration from the Per App VPN configuration drop-down list.
- Click Save.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for the Mail app.
Calendar
To specify the Per App VPN configuration for the Calendar app:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Calendar card, click Settings.
The Calendar window opens.
- Enable the settings using the Calendar toggle switch.
- Click Add.
The Add CalDAV account window opens.
- Add a calendar account.
- In the Per App VPN section, select the Enable Per App VPN check box.
- Select a configuration from the Per App VPN configuration drop-down list.
- Click Add.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for the Calendar app.
Calendar subscriptions
A list of subscriptions to calendars of other CalDAV users, iCal calendars, and other published calendars.
To specify the Per App VPN configuration for calendar subscriptions:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Calendar subscriptions card, click Settings.
The Calendar subscriptions window opens.
- Enable the settings using the Calendar subscriptions toggle switch.
- Click Add.
The Add calendar subscription window opens.
- Add a calendar subscription.
- In the Per App VPN section, select the Enable Per App VPN check box.
- Select a configuration from the Per App VPN configuration drop-down list.
- Click Add.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for calendar subscriptions.
Contacts
To specify the Per App VPN configuration for the Contacts app:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Contacts card, click Settings.
The Contacts window opens.
- Enable the settings using the Contacts toggle switch.
- Click Add.
The Add CardDAV account window opens.
- Add a contacts account.
- In the Per App VPN section, select the Enable Per App VPN check box.
- Select a configuration from the Per App VPN configuration drop-down list.
- Click Add.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for the Contacts app.
Safari
To specify the Per App VPN configuration for Safari:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Per App VPN for Safari card, click Settings.
The Per App VPN for Safari window opens.
- Enable the settings using the Per App VPN for Safari toggle switch.
- Click Add.
The Add a website domain window opens.
- Select a configuration from the Per App VPN configuration drop-down list.
- In the Domain name field, specify the website domain that will trigger the VPN connection in Safari. The domain must be in the
www.example.comformat. - Click Add.
The new domain appears in the Safari website domains list.
You can modify or delete Safari website domains in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for Safari website domains.
LDAP
An LDAP account provides access to corporate data and contacts in the standard iOS apps: Contacts, Messages, and Mail.
To specify the Per App VPN configuration for an LDAP account:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the LDAP card, click Settings.
The LDAP window opens.
- Enable the settings using the LDAP toggle switch.
- Click Add.
The Add LDAP account window opens.
- Add an LDAP account.
- In the Per App VPN section, select the Enable Per App VPN check box.
- Select a configuration from the Per App VPN configuration drop-down list.
- Click Add.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Per App VPN is configured for the LDAP account.
Page topConfiguring Firewall on Android devices (only Samsung)
Configure Firewall settings to monitor network connections on the user's mobile device.
Firewall can be configured only for Samsung devices.
To configure Firewall on a user's mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Samsung Knox settings section.
- On the Firewall card, click Settings.
The Firewall window opens.
- Enable the settings using the Firewall toggle switch.
- In the Internet access drop-down list, select the Firewall mode. Depending on its operating mode, Firewall monitors connections established by the user's mobile device:
- If you want to allow inbound and outbound connections of all installed apps, select Allow for all apps. This mode is selected by default.
- If you want to block all network activity except for several specified apps, select Allow for listed apps.
- If you selected Allow for listed apps as the Firewall mode, create a list of apps for which all network activity is allowed:
- In the Apps with internet access section, click Add.
The Add app window opens.
- In the App name field, enter the name of the mobile app.
- In the Package name field, enter the system name of the mobile app package (for example,
com.mobileapp.example). - Click Add.
The new app for which Firewall is disabled appears in the list.
You can modify or delete mobile apps in the list using the Edit and Delete buttons at the top of the list.
- In the Apps with internet access section, click Add.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topProtecting Kaspersky Endpoint Security for Android against removal
To protect mobile devices and comply with corporate security requirements, you can enable protection against removal of Kaspersky Endpoint Security for Android. In this case, the user cannot remove the app using the Kaspersky Endpoint Security for Android interface. When removing the app using Android operating system tools, you are prompted to disable administrator rights for Kaspersky Endpoint Security for Android. After disabling the rights, the mobile device will be locked.
On certain Samsung devices running Android 7 or later, when the user attempts to configure unsupported methods for unlocking the device (for example, a graphical password), the device may be locked if the following conditions are met: removal protection is enabled for Kaspersky Endpoint Security for Android and strength requirements are set for the screen unlock password. To unlock the device, you must send a special command to the device.
To protect the app from removal on devices running Android 7 or later, Kaspersky Endpoint Security for Android must be set as an Accessibility feature. When the Initial Configuration Wizard is running, Kaspersky Endpoint Security for Android prompts the user to grant the application all required permissions. The user can skip these steps or later disable these permissions in the device settings. If this is the case, the app is not protected from removal.
To enable protection against removal of Kaspersky Endpoint Security for Android:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the KES for Android settings section.
- On the Configure access to app settings card, click Settings.
The Configure access to app settings window opens.
- Enable the settings using the Configure access to app settings toggle switch.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
- Clear the Allow removing the app from device check box.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. If an attempt is made to remove the app, the mobile device will be locked.
Page topDetecting hacked devices
Kaspersky Security Center Web Console lets you detect hacked (rooted) Android devices and jailbreaking on iOS devices. System files are unprotected on a hacked device and can therefore be modified. If a hack attempt is detected, we recommend that you immediately restore normal operation of the device.
If a device is hacked, you receive a notification. You can view hacking notifications in Kaspersky Security Center Web Console in the Monitoring & reporting → Dashboard section. You can also disable notifications about hacks in the event notification settings.
On Android devices, you can impose restrictions on the user's activity if the device is hacked (for example, lock the device). You can impose restrictions using the Compliance Control component. To do this, create a compliance rule with the Device has been rooted criterion.
Page topConfiguring a global HTTP proxy on iOS MDM devices
These settings apply to supervised devices.
To route the user's internet traffic, configure the iOS MDM device connect to the internet through a proxy server.
Be careful when configuring these settings. If the settings are incorrect, devices may lose their internet connection and will not synchronize with the iOS MDM Server. If this happens, you will have to add the devices again.
To configure global HTTP proxy settings on the user's iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Global HTTP proxy card, click Settings.
The Global HTTP proxy window opens.
- Enable the settings using the Global HTTP proxy toggle switch.
- Select the type of global HTTP proxy configuration:
- To specify the proxy server connection settings manually:
- In the Setting type section, select Manual.
- In the Proxy server address and Proxy server port fields, enter the name of a host or the IP address of a proxy server and the number of the proxy server port.
- In the User name field, set the user account name for authorization on the proxy server.
- In the Password field, set the user account password for authorization on the proxy server.
- To allow the user to access captive networks, select the Allow access to captive networks without connecting to proxy check box.
- To configure the proxy server connection settings using a predefined PAC (Proxy Auto Configuration) file:
- In the Setting type section, select Automatic.
- In the PAC file URL field, enter the web address of the PAC file (for example:
http://www.example.com/filename.pac). - To allow the user to connect the mobile device to a wireless network without using a proxy server when the PAC file cannot be accessed, select the Allow direct connection if PAC file cannot be accessed check box.
- To allow the user to access captive networks, select the Allow access to captive networks without connecting to proxy check box.
- To specify the proxy server connection settings manually:
- Click OK.
- Click Save to save the changes you have made.
As a result, the mobile device user will connect to the internet via a proxy server after the policy is applied.
Page topAdding security certificates to iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
You can add certificates to iOS MDM devices to simplify user authentication and ensure data security. The data signed with a certificate is protected against modification while it is transferred over the network. Data encryption using a certificate provides an added level of security for the data. The certificate can also be used to verify user identity.
Kaspersky Mobile Devices Protection and Management supports the following certificate standards:
- PKCS#1. Encryption with a public key based on RSA algorithms.
- PKCS#12. Storage and transmission of a certificate and a private key.
To add a security certificate to iOS MDM devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Certificate management card, click Settings.
The Certificate management window opens.
- Enable the settings using the Certificate management toggle switch.
- Click Upload and specify the path to the certificate.
Files of PKCS#1 certificates have the CER, DER, or PEM extension. Files of PKCS#12 certificates have the P12 or PFX extension. The password for a PKCS#12 certificate must not me empty.
- Click Open.
If the certificate is password-protected, enter the password. The new certificate appears in the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, certificates are automatically installed on devices.
Page topAdding a SCEP profile to iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
You have to add a SCEP profile to enable the iOS MDM device user to automatically receive certificates from the Certification Center via the internet. The SCEP profile enables support of the Simple Certificate Enrollment Protocol.
A SCEP profile with the following settings is added by default:
- The alternative subject name is not used for registering certificates.
- Three attempts are made at 10-second intervals to poll the SCEP server. If all attempts to sign the certificate fail, you have to generate a new certificate signing request.
- The received certificate cannot be used for data signing or encryption.
You can edit the specified settings when adding the SCEP profile.
To add a SCEP profile:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the SCEP card, click Settings.
The SCEP window opens.
- Enable the settings using the SCEP toggle switch.
- Click Add.
The Add SCEP profile window opens.
- In the SCEP Server section, specify the following SCEP server settings:
- In the Configuration name field, specify the name of the Certification Center deployed on the SCEP server. The Certification Center supplies the user of an iOS MDM device with certificates using the Simple Certificate Enrollment Protocol (SCEP).
- In the Server URL field, enter the web address of the SCEP server on which the Certification Center is deployed.
The URL can contain the IP address or the full domain name (FQDN). For example,
http://10.10.10.10/certserver/companyscep. - In the Maximum number of polling attempts field, specify the maximum number of attempts to poll the SCEP server to get the certificate signed. By default, the value is 3 attempts.
If all attempts to sign the certificate fail, you have to generate a new certificate signing request.
- In the Polling interval (sec) field, specify the number of seconds between attempts to poll the SCEP server to get the certificate signed. By default, the value is 10 seconds.
- In the Static challenge phrase field, enter a pre-published registration key.
Before signing a certificate, the SCEP server prompts the mobile device user to enter the key. If this field is left blank, the SCEP does not request the key.
- In the Method for uploading certificate thumbprint drop-down list, select how to add a certificate thumbprint. You can use certificate thumbprints based on the SHA-1 or MD5 hashing algorithm.
- If you selected the Manually option, in the Certificate thumbprint field that appears, enter a unique certificate thumbprint for verifying the authenticity of the response from the Certification Center.
- If you selected the From file option, upload a CER, KEY, or PEM file. The thumbprint will be generated and added automatically.
The certificate thumbprint has to be specified if data exchange between the mobile device and the Certification Center takes place via the HTTP protocol.
- In the Subject section, specify the following settings:
- In the Subject Name field, enter a string with the attributes of the iOS MDM device user that are contained in the X.500 certificate.
Attributes can contain details of the country (C), locality (L), state (ST), organization (O), organization unit (OU), and common user name (CN). For example,
/C=RU/O=MyCompany/CN=User/.You can also use other attributes specified in RFC 5280.
Attributes are used by DNS services to validate the certificate issued by the Authentication Authority at the user's request.
- Click the Add Subject Alternative Name button to add a field for specifying the subject alternative name:
- In the Type of Subject Alternative Name drop-down list that appears, select the type of subject alternative name for the SCEP server. You can add only one alternative name of each type.
You can use a subject alternative name to identify the user of the iOS MDM device. By default, identification based on the alternative name is not used.
- DNS name. Identification using the domain name.
- NT Principal Name. DNS name of the iOS MDM device user on the Windows NT network. The NT subject name is contained in the certificate request sent to the SCEP server. You can also use the name of the NT subject to identify the user of the iOS MDM device.
- Email address. Identification using the email address. The email address must be specified according to RFC 822.
- Uniform Resource Identifier (URI). Identification using the IP address or address in FQDN format.
- In the Subject Alternative Name field, enter the alternative name of the subject of the X.500 certificate. The value of the subject alternative name depends on the selected subject type: the user's email address, domain, or web address.
- In the Type of Subject Alternative Name drop-down list that appears, select the type of subject alternative name for the SCEP server. You can add only one alternative name of each type.
- In the Subject Name field, enter a string with the attributes of the iOS MDM device user that are contained in the X.500 certificate.
- In the Key section, configure the encryption key settings:
- In the Key size (bit) drop-down list, select the size of the registration key in bits: 1024, 2048, or 4096. The default value is 1024 bits.
- If you want to allow the user to use a certificate received from the SCEP server as a signing certificate, select the Use as digital signature check box.
Data signing protects data against modification. For example, Safari can validate the authenticity of the certificate and establish a safe data exchange session.
- If you want to allow the user to use a certificate received from the SCEP server for data encryption, select the Use for encryption check box.
Data encryption also protects confidential data during data exchange over a network. For example, Safari can establish a secure data exchange session using encryption. This guarantees website authenticity and confirms that the connection to the website is encrypted to prevent interception of personal and confidential data.
You cannot simultaneously use the SCEP server certificate as a data signing certificate and a data encryption certificate.
- If you want to allow all installed apps to access the private key from the SCEP server certificate, select the Allow all apps to access private key check box.
- If you do not want the private key to be exported from the keychain, select the Prohibit exporting private key from the keychain check box.
- Click Add.
The new SCEP profile appears in the list.
You can modify or delete SCEP profiles in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, the user's mobile device is configured to automatically receive a certificate from the Certification Center via the internet.
Page topRestricting SD card usage (only Samsung)
Configure SD card restrictions to control usage of SD cards on the user's Samsung device that supports Knox.
To restrict SD card usage on a mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Samsung Knox settings section.
- On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
- Enable the settings using the Device feature restrictions toggle switch.
- In the SD card settings section, specify the required restrictions:
- In the Additional settings section, you can specify any additional restrictions:
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. SD card settings are now configured.
Page topManagement of mobile devices
This section contains information about how to remotely manage mobile devices in Kaspersky Security Center Web Console.
Managing Android devices
Kaspersky Security Center Web Console lets you manage Android devices in the following ways:
- Centrally manage devices by using commands.
- View information about the settings for management of Android devices.
- Install apps by using mobile app packages.
- Disconnect Android devices from management.
Corporate devices
This section contains information about managing the settings of corporate Android devices. For information about installing Kaspersky Endpoint Security for Android on corporate devices, see here.
Restricting Android features on devices
These settings apply to corporate devices.
You can restrict Android operating system features on corporate devices. For example, you can restrict factory reset, changing credentials, use of Google Play and Google Chrome, file transfer over USB, changing location settings, and management of system updates. You can also restrict operating system features on personal devices and devices with a corporate container.
To restrict Android features:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Restrictions section.
- On the Device feature restrictions card, click Settings.
The Device feature restrictions window opens.
- Enable the settings using the Device feature restrictions toggle switch.
- Enable device feature restrictions using toggle switches on the corresponding tabs and select the required restrictions.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Restrict device features
On the General tab, you can enable or disable the following features.
- Features in the Data loss protection section:
- Features in the Calls and SMS section:
- Features in the Location services section:
- Features in the Keyguard section:
- Features in the Users and accounts section:
Restrict app features
On the Apps tab, you can enable or disable the following features.
- Features in the General section:
- Features in the Google apps section:
- Features in the Camera section:
- Granting runtime permissions for apps
Restrict storage features
On the Storage tab, in the General section, you can enable or disable the following features.
- Prohibit debugging features
- Prohibit mounting physical external media
- Prohibit file transfer over USB
- Prohibit backup service
Restrict network features
On the Network tab, you can enable or disable the following features.
- Features in the General section:
- Features in the Wi-Fi section:
- Features in the Bluetooth section:
- Features in the Mobile networks section:
Additional restrictions
On the Additional settings tab, you can enable or disable the following features.
- Features in the Language, date, and time section:
- Features in the Display section:
- Features in the Screen on section:
- Features in the Microphone section:
- Features in the Volume section:
Restrict system updates
Management of update settings on mobile devices is vendor-specific. On some Android devices, the restriction on manual installation of operating system updates may not work correct.
On the OS update tab, you can configure the following settings.
- In the Update mode section:
- In the Freeze periods section:
Configuring kiosk mode for Android devices
These settings apply to corporate devices.
Kiosk mode is a Kaspersky Endpoint Security for Android feature that lets you limit the apps available to a device user to a single app or a set of multiple apps. You can also efficiently manage some device settings.
Kiosk mode does not affect the work of the Kaspersky Endpoint Security for Android app. It runs in the background, shows notifications, and can be updated.
Types of kiosk modes
The following types of kiosk mode are available in Kaspersky Endpoint Security:
- Single-app mode
Kiosk mode with only a single app. In this mode, a device user can open only the one app that is allowed on the device and specified in the kiosk mode settings. If the app that you want to add to kiosk mode is not installed on the device, kiosk mode activates after the app is installed.
On Android 9 or later, the app launches directly in kiosk mode.
On Android 8 or earlier, the specified app must support kiosk mode functionality and call the
startLockTask()method itself to launch the app. - Multi-app mode
Kiosk mode with multiple apps. In this mode, a device user can open only the set of apps that are allowed on the device and specified in the kiosk mode settings.
Before you configure kiosk mode
Before you configure kiosk mode, do the following:
- Before specifying the apps that are allowed to be run on the device in kiosk mode, you first need to select the Install action for these apps on the App management tab of the App Control card. Then, they will appear in the App package list of the kiosk mode.
- Before activating kiosk mode, we recommend that you prohibit starting Google Assistant by enabling the corresponding restriction in Assets (Devices) → Policies & profiles → Application settings → Android → Restrictions → Device feature restrictions → Apps → Prohibit Google Assistant. Otherwise, Google Assistant starts in kiosk mode and allows non-trusted apps to be opened.
Open the kiosk mode settings
To open the kiosk mode settings:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Restrictions section.
- On the Kiosk mode card, click Settings.
The Kiosk mode window opens.
Configure single-app mode
To configure single-app mode:
- Enable the settings using the Kiosk mode toggle switch.
- In the Operating mode drop-down list, select Single-app mode.
- In the App package drop-down list, select an app package with the app that is allowed to be run on the device.
- Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
- Select the Allow navigation to trusted apps check box if you want to add other apps that a device user can navigate to. For more details, see the "Add additional apps" section below.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Configure multi-app mode
To configure multi-app mode:
- Enable the settings using the Kiosk mode toggle switch.
- In the Operating mode drop-down list, select Multi-app mode.
- Click Add package and select the apps that are allowed to be run on the device.
- Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
- Select the Allow navigation to trusted apps check box if you want to add other apps that a device user can navigate to. For more details, see the "Add additional apps" section below.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Kiosk mode restrictions
You can set the following restrictions in kiosk mode:
Add additional apps
Besides locking the device to a single app or set of apps, you can also specify additional apps, that the main app can use. These additional apps allow the apps added to kiosk mode to provide their full functionality. For example, the user can view a document or access a website opened from the main app. By default, these additional apps are hidden on a device and a user cannot launch them manually.
To add additional apps:
- In the Additional apps section, select the Allow navigation to trusted apps check box.
- Click Add package and specify the desired app package name.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Connecting to a NDES/SCEP server
These settings apply to corporate devices.
You can connect to an NDES/SCEP server to obtain a certificate from a certificate authority (CA) using the Simple Certificate Enrollment Protocol (SCEP). To do this, you need to add a connection to the certificate authority and a certificate profile.
To add a connection to the certificate authority and a certificate profile:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Device configuration section.
- On the SCEP and NDES card, click Settings.
The SCEP and NDES window opens.
- Enable the settings using the SCEP and NDES toggle switch.
The Add connection to certificate authority window opens.
- Add a connection to the certificate authority:
- In the Connection name field, enter the name of the connection to the certificate authority.
- In the Protocol type drop-down list, select the protocol version.
- In the Server URL field, enter the URL of a NDES or SCEP server.
The format of the NDES server URL is
http://<ServerName>/certsrv/mscep/mscep.dll. - In the Challenge phrase type drop-down list, select one of the following options to configure the authentication challenge:
- If you selected the Static option, in the Static challenge phrase field, enter the authentication phrase.
- Click Add.
The connection to the certificate authority is added. You can add multiple connections to certificate authorities.
- Select the Certificate profile tab and click Add.
The Add profile window opens.
- Add a certificate profile:
- In the General settings section, in the Profile name field, enter the unique certificate profile name.
- In the Certificate authority (CA) drop-down list select the certificate authority that you added on the Certificate authority tab.
- In the Subject Name field specify the subject of the certificate. Subject name is a unique identifier that includes information about what is being certified, such as common name, organization, organizational unit, and country code. You can either enter a value or select a macro by clicking the
button. - If you want to add an alternative name that represents the certificate subject name, click Add Subject Alternative Name and configure the following settings:
- In the Type of Subject Alternative Name drop-down list select the subject alternative name type.
- In the Subject Alternative Name field enter the alternative name. You can either enter a value or select a macro by clicking the button.
You can add multiple subject alternative names.
- In the Key section, in the Key size (bit) drop-down list, select the certificate's private key length.
- In the Private key type drop-down list select the certificate's private key type:
- If you want the certificate to be automatically reissued to the device before it expires, in the Certificate section, select the Renew certificate automatically check box. This check box is cleared by default.
- If you selected the Renew certificate automatically check box, enter the number of days before the expiration date when the certificate is reissued in the Renew certificate before it expires in (days) field.
- Click Add.
The certificate profile is added. You can add multiple certificate profiles.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
You can edit or remove the added connections to certificate authorities and certificate profiles by clicking Edit and Delete at the top of the list.
If you delete a connection to a certificate authority, all certificate profiles that use it are also removed.
Page topEnabling certificate-based authentication of devices
To enable certificate-based authentication of a device:
- Open the command line on a device where the Administration Server is installed.
- Go to the directory containing the klscflag utility.
By default, the utility is located in
/opt/kaspersky/ksc64/sbin. - Run the following command under an account with root privileges to configure certificate-based authentication of devices on the Administration Server:
./klscflag -fset -pv ".core/.independent" -s KLLIM -n LP_MobileMustUseTwoWayAuthOnPort13292 -t d -v 1
- Restart the Administration Server service.
After you start the Administration Server service, certificate-based authentication of the device using a shared certificate will be required.
The first connection of the device to the Administration Server does not require a certificate.
By default, certificate-based authentication of devices is disabled.
Page topCreating a mobile application package for Android devices
To create a mobile app package:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
- Click Android apps, and then click Add.
The Add app window opens.
- Specify the app name in the App name field. This name will be used to identify the app in policy settings.
- Click Select and select an APK file on your computer.
- Click Save to save the changes you have made.
The newly created app package is displayed in the list of apps on the Android apps tab.
If you select a large APK file, the app may take some time to upload. Do not close the Apps section until the app is uploaded.
In the Apps section, you can also add iOS apps.
Viewing information about an Android device
To view information about an Android device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
The list of managed mobile devices opens.
- To filter Android devices, click the OS column heading and select Android.
The list of Android devices is displayed.
Depending on the database you use, searches may be case-sensitive.
- Select the mobile device you want to view information about.
A window with the properties of the Android device opens.
The mobile device properties window displays information about the connected Android device.
If an old version of Kaspersky Endpoint Security for Android (10.52.1.3 or earlier) is installed on the devices the Operating mode value is set to Unknown.
Disconnecting an Android device from management
To disconnect an Android device from management, the user has to remove Kaspersky Endpoint Security for Android from the mobile device. After the user has removed Kaspersky Endpoint Security for Android, the administrator can remove the mobile device from the list of managed devices in Web Console.
If Kaspersky Endpoint Security for Android has not been removed from the mobile device, that mobile device reappears in the list of managed devices after synchronization with the Administration Server.
To remove an Android device from the list of managed devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
The list of managed mobile devices opens.
- To filter Android devices, click the OS column heading and select Android.
The list of Android devices is displayed.
- Select the mobile device you want to disconnect.
- Click Delete.
The mobile device is removed from the list of managed devices.
Page topManaging iOS MDM devices
This section describes advanced features for management of iOS MDM devices in Kaspersky Security Center Web Console.
Adding a configuration profile
To create a configuration profile, you can use Apple Configurator 2, which is available on the Apple website. Apple Configurator 2 works only on devices running macOS. If you do not have such devices at your disposal, you can use iPhone Configuration Utility. However, Apple no longer supports iPhone Configuration Utility.
To add a configuration profile to an iOS MDM Server:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → iOS MDM Servers. In the list of iOS MDM Servers that opens, click the iOS MDM Server whose settings you want to configure.
- In the iOS MDM Server settings window, select Application settings.
- Select the Configuration profiles tab.
- To add a new configuration profile, click Add.
- In the window that opens, select the configuration profile that you want to add.
The configuration profile name should not be longer than 100 characters. If you enter a longer name, only part of it will be displayed.
The new configuration profile will be displayed in the list of configuration profiles.
You can install the profile that you have created on iOS MDM devices.
Page topInstalling a configuration profile on a device
To install a configuration profile on an iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select the devices that you want to install configuration profiles on.
- Click Send command.
- In the Send command window that opens, in the Command field, select the Install configuration profile command.
- In the Configuration profiles section, select the configuration profiles that you want to install on the devices.
- Click Send.
The command is sent to the devices you selected.
To view the list of configuration profiles installed on a device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, click the device whose properties you want to view.
The device properties window opens.
- Select the Configuration profiles tab.
The list of configuration profiles installed on the device is displayed.
Page topRemoving a configuration profile from a device
To remove a configuration profile from an iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select the devices that you want to remove configuration profiles from.
- Click Send command.
- In the Send command window that opens, in the Command field, select the Delete configuration profile command.
- In the Configuration profiles section, select the configuration profiles that you want to remove from the devices.
- Click Send.
The command is sent to the devices you selected.
The profile may be displayed in the list of configuration profiles installed on the device for several minutes after it has been deleted.
To view the list of configuration profiles installed on a device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, click the device whose properties you want to view.
The device properties window opens.
- Select the Configuration profiles tab.
The list of configuration profiles installed on the device is displayed.
Page topConfiguring managed apps
Before installing an app on an iOS MDM device, you must add that app to the Administration Server. An app is considered managed if it has been installed on a device through Kaspersky Mobile Devices Protection and Management. A managed app can be managed remotely by means of Kaspersky Mobile Devices Protection and Management.
To add a managed app to an iOS MDM Server:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps.
- Click iOS apps, and then click Add.
The Add app window opens.
- Specify the app name in the App name field. This name will be used to identify the app in policy settings.
- In the Installation method field, select one of the following methods to add the app:
- Installation package
- Link to manifest file
A manifest file is a PLIST file, which is required to install an app on an iOS device. These files are dictionaries containing app installation settings (for example, the location of the installation package). When you use a manifest file to add an app, you have to fill in these settings manually. When you add an app from the App Store or an IPA file, the manifest file is generated automatically.
To get a manifest file for an app, we recommend first adding the app to the iOS MDM Server using an IPA file. In this case, the iOS MDM Server automatically generates a manifest file, which you can download and modify later.
- App Store
- Do one of the following:
- If you selected Installation package, click Select, and upload an IPA file from your computer.
- If you selected Link to manifest file, specify a link to a manifest file that can be used to download the app.
- If you selected App Store, specify a link or ID of the app to be added from the App Store.
- If necessary, configure the following settings:
- Select the Remove when device management profile is deleted check box if you want the app to be removed from the user's mobile device along with the device management profile. By default, this check box is selected.
- Select the Block backup of app data to iCloud check box if you want to block backup of the app data to iCloud.
- If you want to add a custom configuration for the app, in the App configuration section, click Select and select a configuration file in PLIST format on your computer.
To generate a configuration file, you can use a configuration generator (for example, https://appconfig.jamfresearch.com/generator) or refer to the official documentation on the app to be configured.
Example of a basic configuration for the Microsoft Outlook app
Example of a configuration file for the Microsoft Outlook app
You can use macros in the corresponding fields of the configuration file to replace values. Available macros
- Click Save to save the changes you have made.
The newly created app is displayed in the table of apps on the iOS apps tab.
If you select a large IPA file, the app may take some time to upload. Do not close the Apps section until the app is uploaded.
You can view and edit app properties by clicking the app in the list or remove the app using the Delete button.
Installing an app on a mobile device
To install an app on a mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select the devices that you want to install apps on.
- Click Send command.
- In the Send command window that opens, in the Command field, select the Install app command.
- In the Apps field, select the apps that you want to install on the devices.
- Click Send.
The command is sent to the devices you selected.
Page topRemoving an app from a device
To remove an app from a mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select the devices that you want to remove apps from.
- Click Send command.
- In the Send command window that opens, in the Command field, select the Delete app command.
- In the Apps section, select the apps that you want to remove from the devices.
- Click Send.
The command is sent to the devices you selected.
Configuring roaming on an iOS MDM mobile device
To configure roaming:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select the devices that you want to configure roaming settings for.
- Click Send command.
- In the Send command window that opens, in the Command field, select the Change roaming settings command.
- In the Action section, do one of the following:
- If you want to enable data roaming, select Enable data roaming.
- If you want to disable data roaming, select Disable data roaming.
- Click Send.
The command is sent to the devices you selected.
Page topViewing information about an iOS MDM device
To view information about an iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
The list of managed mobile devices opens.
- To filter iOS MDM devices, click the Operating mode column heading and select the operating mode of the iOS MDM device you want to view information about.
The list of iOS MDM devices is displayed.
Depending on the database you use, searches may be case-sensitive.
- Select the mobile device you want to view information about.
A window with the properties of the iOS MDM device opens.
The General tab of the properties window displays information about the connected iOS MDM device.
The Certificates tab of the properties window displays information about the certificates installed on the selected iOS MDM device.
The Apps tab of the properties window displays information about the apps installed on the selected iOS MDM device.
The Configuration profiles tab of the properties window displays information about the configuration profiles installed on the selected iOS MDM device.
Disconnecting an iOS MDM device from management
If you want to stop managing an iOS MDM device, you can disconnect it from management in Kaspersky Security Center.
As an alternative, you or the device owner can remove the device management profile from the device. However, after that you must still disconnect the device from management, as described in this section. Otherwise, you will not be able to start managing this device again.
To disconnect an iOS MDM device from the iOS MDM Server:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
The list of managed mobile devices opens.
- To filter iOS MDM devices, click the Operating mode column heading and select the operating mode of the iOS MDM device you want to disconnect.
The list of iOS MDM devices operating in the selected mode is displayed.
- Select the mobile device you want to disconnect.
- Click Delete.
In the list, the iOS MDM device is marked for removal. Within one minute, the device is removed from the database of the iOS MDM Server, after which it is automatically removed from the list of managed devices.
After the iOS MDM device is disconnected from management, all installed configuration profiles, the device management profile, and apps for which the Remove when device management profile is deleted option has been enabled in the iOS MDM Server settings, will be removed from the device. The iOS MDM policy will also be deleted.
Page topConfiguring kiosk mode for iOS MDM devices
These settings apply to supervised devices.
Kiosk mode is an iOS feature that lets you limit the apps available to a device user to a single app. In this mode, a device user can open only the one app that is allowed on the device and specified in the kiosk mode settings.
Open the kiosk mode settings
To open the kiosk mode settings:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Restrictions section.
- On the Kiosk mode card, click Settings.
The Kiosk mode window opens.
Configure kiosk mode
To enable kiosk mode:
- Enable the settings using the Kiosk mode toggle switch to activate kiosk mode on a supervised device.
- In the Bundle ID field, enter the unique identifier of an app selected for kiosk mode (for example, com.apple.calculator).
How to get the bundle ID of an app
To select a different app, you need to disable kiosk mode, save the changes to the policy, and enable kiosk mode for a new app.
The app that is selected for kiosk mode must be installed on the device. Otherwise, the device will be locked until kiosk mode is disabled.
The use of the selected app must also be allowed in the policy settings. If the use of the app is prohibited, kiosk mode will not be enabled until the selected app is removed from the list of forbidden apps.
In some cases, kiosk mode can still be enabled even when the use of the selected app is prohibited in the policy settings.
- Specify the settings that will be enabled on the device in kiosk mode in the corresponding section. For available settings, see the "Kiosk mode settings" section below.
- Specify the settings that the user can edit on the device in kiosk mode in the corresponding section.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, kiosk mode is enabled. The selected app is forced to open on a supervised device, and the use of other apps is prohibited. The selected app reopens immediately after the device is restarted.
To edit the kiosk mode settings, you need to disable kiosk mode, save changes to the policy, and then enable kiosk mode again with the new settings.
To disable kiosk mode:
- Disable the settings using the Kiosk mode toggle switch to deactivate kiosk mode on a supervised device.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, kiosk mode is disabled and the use of all apps is allowed on the supervised device.
Now, you can enable kiosk mode again with the new settings.
Kiosk mode settings
- Auto-Lock
- Touch (not recommended to disable)
- AssistiveTouch
- Voice Control
- VoiceOver
- Speak Selection
- Volume Buttons
- Mono Audio
- Zoom
- Auto-Rotate Screen
- Invert Colors
- Ring/Silent Switch
- Sleep/Wake Button
Management of mobile device settings
This section contains information about how to remotely manage the settings of mobile devices in Kaspersky Security Center Web Console.
Configuring connection to a Wi-Fi network
This section provides instructions on how to configure automatic connection to a corporate Wi-Fi network on Android and iOS MDM devices.
Connecting Android devices to a Wi-Fi network
For an Android device to automatically connect to an available Wi-Fi network and protect data during the connection, you must configure the connection settings.
To connect a mobile device to a Wi-Fi network:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Device configuration section.
- On the Wi-Fi card, click Settings.
The Wi-Fi window opens.
- Enable the settings using the Wi-Fi toggle switch.
- Click Add.
The Add Wi-Fi network window opens.
- In the Service set identifier (SSID) field, enter the name of the Wi-Fi network that includes the access point (SSID).
- Select the Connect automatically check box if you want Android devices to automatically connect to the Wi-Fi network.
- Select the Hidden network check box if you want the Wi-Fi network to be hidden in the list of available networks on the device.
In this case, to connect to the network the user needs to manually enter the service set identifier (SSID) specified in the settings of the Wi-Fi router on the mobile device.
- In the Protection section, select the type of Wi-Fi network security (open network or secure network protected with the WEP, WPA2 PSK, or 802.1.x EAP protocol).
The 802.1.x EAP security protocol is supported only in Kaspersky Endpoint Security for Android 10.48.1.1 or later. The WEP protocol is supported only on Android 9 or earlier.
- If you selected the 802.1.x EAP security protocol, specify the following network protection settings:
- In the Password field, set a network access password if you selected a secure network at step 9.
- On the Additional settings tab, select the Use a proxy server check box if you want to use a proxy server to connect to the Wi-Fi network.
- If you selected Use a proxy server, in the Proxy server address and Proxy server port fields, enter the IP address or DNS name of the proxy server and port number, if necessary.
On devices running Android 8 or later, proxy server settings for Wi-Fi cannot be redefined with a policy. However, you can manually configure the proxy server settings for a Wi-Fi network on the mobile device.
If you are not using a proxy server to connect to a Wi-Fi network, there are no limitations on using policies to manage a Wi-Fi network connection.
- In the Do not use proxy server for the specified addresses field, add web addresses that can be accessed without the use of the proxy server.
For example, you can enter the address
example.com. In this case, the proxy server will not be used for the addressespictures.example.com,example.com/movies, etc. The protocol (for example,http://) can be omitted.On devices running Android 8 or later, excluding web addresses from the proxy server does not work.
- Click Add.
The added Wi-Fi network is displayed in the list of Wi-Fi networks.
This list contains the names of suggested wireless networks.
On personal devices running Android 10 or later, the operating system prompts the user to connect to such networks. Suggested networks don't appear in the saved networks list on these devices.
On corporate devices and personal devices running Android 9 or earlier, after synchronizing the device with the Administration Server, the device user can select a suggested wireless network in the saved networks list and connect to it without having to specify any network settings.
You can modify or delete Wi-Fi networks in the list of networks using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
On devices running Android 10 or later, if a user refuses to connect to the suggested Wi-Fi network, the app's permission to change Wi-Fi state is revoked. The user must grant this permission manually.
Page topConnecting iOS MDM devices to a Wi-Fi network
For an iOS MDM device to automatically connect to an available Wi-Fi network and protect data during the connection, you must configure the connection settings.
To configure the connection of an iOS MDM device to a Wi-Fi network:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Wi-Fi card, click Settings.
The Wi-Fi window opens.
- Enable the settings using the Wi-Fi toggle switch.
- Click Add.
The Add Wi-Fi network window opens.
- In the Service set identifier (SSID) field, enter the name of the Wi-Fi network that includes the access point (SSID).
- If you want iOS MDM devices to automatically connect to the Wi-Fi network, select the Connect automatically check box.
If you disable automatic connection to an existing Wi-Fi network in the policy settings, you will not be able to enable automatic connection to this network again. This is due to an issue known to Apple.
- If you don't want iOS MDM devices to connect to Wi-Fi networks requiring preliminary authentication (captive networks), select the Bypass captive portal check box.
To use a captive network, you must subscribe, accept an agreement, or make a payment. Captive networks may be deployed in cafes and hotels, for example.
- If you want the Wi-Fi network to be hidden in the list of available networks on the iOS MDM device, select the Hidden network check box.
In this case, to connect to the network the user needs to manually enter the service set identifier (SSID) specified in the settings of the Wi-Fi router on the mobile device.
- If you want iOS MDM devices to use static MAC addresses when they connect to the Wi-Fi network, select the Disable MAC address randomization check box.
- In the Protection section, select the type of Wi-Fi network security (open network or secure network protected with the WEP, WPA, WPA2, or WPA3 protocol).
On devices running iOS 15 or earlier, selecting WPA, WPA2, or WPA3 is identical and lets you connect to any network protected using WPA.
- Open network. User authentication is not required.
- WEP. The network is protected using Wireless Encryption Protocol (WEP).
WEP protection is available on devices running iOS 5 or later.
- WPA. The network is protected using the WPA (Wi-Fi Protected Access) or WPA2 protocol.
- WPA2. The network is protected using the WPA2 or WPA3 protocol.
- WPA3. The network is protected using the WPA3 protocol.
- Personal network (any). The network is protected using the WEP, WPA, WPA2, or WPA3 encryption protocol depending on the type of Wi-Fi router. An encryption key unique to each user is used for authentication.
- WEP (corporate network). The network is protected using the WEP protocol with the use of a dynamic key.
- WPA (corporate network). The network is protected using the WPA or WPA2 encryption protocol with the use of the 802.1X protocol.
- WPA2 (corporate network). The network is protected using the WPA2 or WPA3 encryption protocol with the use of one key shared by all users (802.1X).
- WPA3 (corporate network). The network is protected using the WPA3 encryption protocol with the use of one key shared by all users (802.1X).
- Corporate network (any). The network is protected using the WEP, WPA, WPA2, or WPA3 protocol depending on the type of Wi-Fi router. Authentication is performed using a single encryption key shared by all users.
If you have selected any of the corporate network options, in the EAP protocol section you can select the types of EAP protocols (Extensible Authentication Protocol) for user identification on the Wi-Fi network.
In the Trusted certificates section, you can also create a list of trusted certificates for authentication of the iOS MDM device user on trusted servers.
- In the Authentication section, configure the settings of the account for user authentication upon connection of the iOS MDM device to the Wi-Fi network:
- In the User name field, enter the account name for user authentication upon connection to the Wi-Fi network.
- In the User ID field, enter the user ID displayed during data transmission upon authentication instead of the user's real name.
The user ID is designed to make the authentication process more secure, since the user name is not displayed openly, but rather transmitted via an encrypted TLS tunnel.
- In the Password field, enter the password of the account for authentication on the Wi-Fi network.
- If you want the user to enter the password manually upon every connection to the Wi-Fi network, select the Prompt for password at each connection check box.
- In the Authentication certificate drop-down list, select a certificate for user authentication on the Wi-Fi network.
- In the Minimum TLS version drop-down list, select the minimum allowed TLS version.
- In the Maximum TLS version drop-down list, select the maximum allowed TLS version.
- If necessary, on the Additional settings tab, configure the settings for connecting to the Wi-Fi network via a proxy server:
- Select the Use a proxy server check box.
- Configure a connection to a proxy server:
- If you want to configure the connection automatically:
- Select Automatic.
- In the PAC file URL field, specify the URL of the proxy PAC file.
- To allow the user to connect the mobile device to a wireless network without using a proxy server when the PAC file cannot be accessed, select the Allow direct connection if PAC file cannot be accessed check box.
- If you want to configure the connection manually:
- Select Manual.
- In the Proxy server address and Proxy server port fields, enter the IP address or DNS name of the proxy server and port number.
- In the User name field, select a macro that will be used as a user name for the connection to the proxy server.
- In the Password field, specify the password for the connection to the proxy server.
- If you want to configure the connection automatically:
- Click Add.
The new Wi-Fi network is displayed in the list.
- Click OK.
- Click Save to save the changes you have made.
As a result, a Wi-Fi network connection will be configured on the user's iOS MDM device once the policy is applied. The user's mobile device will automatically connect to available Wi-Fi networks. Data security during a Wi-Fi network connection is ensured by the selected authentication method.
Page topConfiguring email
This section contains information on configuring mailboxes on mobile devices.
Configuring a mailbox on iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
To enable an iOS MDM device user to work with email, add the user's email account to the list of accounts on the iOS MDM device.
By default, the email account is added with the following settings:
- Email protocol – IMAP.
- The user can move email messages between the user's accounts and synchronize account addresses.
- The user can use any email client (other than Mail) to use email.
- The SSL connection is not used during transmission of messages.
You can edit the specified settings when adding an account.
To add an email account of the iOS MDM device user:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Email card, click Settings.
The Email window opens.
- Enable the settings using the Email toggle switch.
- Click Add.
The Add email account window opens.
- Specify the email account settings:
- On the General settings tab, configure the following settings:
- In the User name field, specify the name of the iOS MDM device user. You can either enter a value or select a macro by clicking the button.
- In the Email address field, specify the email address of the iOS MDM device user. You can either enter a value or select a macro by clicking the button.
- In the Account description field, enter a description of the user's email account.
- In the Email protocol field, select one of the following protocols:
- POP
- IMAP
- If you selected IMAP, specify the IMAP path prefix in the IMAP path prefix field.
The IMAP path prefix must be entered using uppercase letters (for example: GMAIL for Google Mail).
- In the Incoming mail server settings and Outgoing mail server settings sections, configure the server connection settings:
- In the Server address field, specify names of hosts or IP addresses of incoming and outgoing mail servers.
- In the Server port fields, specify the port numbers of incoming and outgoing mail servers.
To configure optional settings for the incoming and outgoing mail servers, click More settings and do the following:
- In the User name field, specify the name of the user's account for authorization on the incoming and outgoing mail servers. You can either enter a value or select a macro by clicking the button.
- In the Authentication type field, select the type of authentication of the user's email account on the incoming and outgoing mail servers.
- In the Password field, specify the account password for authenticating on incoming and outgoing mail servers protected using the selected authentication method.
- If you want to use the SSL (Secure Sockets Layer) data transport protocol, select the Use SSL connection check box.
- If you want to use the same password for user authentication on the incoming and outgoing mail servers, select the Use the same password for incoming and outgoing mail servers check box.
- In the User name field, specify the name of the iOS MDM device user. You can either enter a value or select a macro by clicking the
- On the Advanced settings tab, configure the additional settings of the email account:
- In the Restrictions section, select or clear the following check boxes, if necessary:
- In the Signature and Encryption sections, configure the settings for signing and encrypting outgoing mail using the S/MIME protocol in the Mail app.
S/MIME is a protocol for transmitting digitally signed encrypted messages. S/MIME provides cryptographic security capabilities such as authentication, message integrity control, and non-repudiation of origin (using digital signatures). The protocol also helps improve the confidentiality and security of data in email messages by using encryption.
- Sign messages
- Signing certificate for outgoing messages
- Encrypt messages by default
- Encryption certificate
- Show toggle button for encrypting selected messages
Display of the
icon in the Mail app in the To field for sending encrypted messages.If this check box is selected, the mobile device user can encrypt individual messages by clicking the icon.
If the check box is cleared, the icon for encrypting messages is not displayed. In this case, the Encrypt messages by default check box determines whether outgoing mail is encrypted.
- If necessary, in the Per App VPN section, configure Per App VPN.
- On the General settings tab, configure the following settings:
- Click Save.
The new email account appears in the list.
You can modify or delete email accounts in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, email accounts from the list are added on the user's mobile device.
We recommend closing and opening the Settings app on the iOS MDM device after you configure a mailbox.
Page topConfiguring an Exchange mailbox on iOS MDM devices
These settings apply to supervised devices and devices operating in basic control mode.
To allow an iOS MDM device user to use corporate email, calendar, contacts, notes, and tasks, add the user's Exchange ActiveSync account on the Microsoft Exchange server.
By default, an account with the following settings is added on the Microsoft Exchange server:
- Email is synchronized once per week.
- The user can move messages between the user's accounts and synchronize account addresses.
- The user can use any email clients (other than Mail) to use email.
- The SSL connection is not used during transmission of messages.
You can edit the specified settings when adding the Exchange ActiveSync account.
To add an Exchange ActiveSync account of an iOS MDM device user:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Exchange ActiveSync card, click Settings.
The Exchange ActiveSync window opens.
- Enable the settings using the Exchange ActiveSync toggle switch.
- Click Add.
The Add Exchange ActiveSync account window opens.
- Specify the Exchange ActiveSync settings:
- On the General settings tab, specify the user's data:
- In the Account name field, enter the account name for authorization on the Microsoft Exchange server. You can either enter a value or select a macro by clicking the button.
- In the Exchange ActiveSync server address field, enter the DNS name or IP address of the Microsoft Exchange server.
- Settings in the User credentials section:
- In the User domain field, enter the name of the iOS MDM device user's domain. You can either enter a value or select a macro by clicking the button.
- In the User name field, enter the name of the iOS MDM device user. You can either enter a value or select a macro by clicking the button.
If you leave this field blank, Kaspersky Mobile Devices Protection and Management prompts the user to enter the user name when applying the policy on the iOS MDM device.
- In the Email address field, specify the email address of the iOS MDM device user. You can either enter a value or select a macro by clicking the button.
- In the User domain field, enter the name of the iOS MDM device user's domain. You can either enter a value or select a macro by clicking the
- Settings in the Authentication section:
- In the Password field, enter the password of the Exchange ActiveSync account for authorization on the Microsoft Exchange server.
- In the Authentication certificate drop-down list, select the certificate used for authenticating the iOS MDM device user on the Microsoft Exchange server. You can add certificates in the Certificate management settings of the policy or in the Certificates section of Web Console.
- In the Account name field, enter the account name for authorization on the Microsoft Exchange server. You can either enter a value or select a macro by clicking the
- On the Additional settings tab, configure the additional settings of the Exchange ActiveSync account:
- In the Email synchronization section, in the Synchronization period drop-down list, select the time interval for which email is automatically synchronized and stored on the iOS MDM device. The longer the email synchronization period, the more free space required in the memory of the mobile device. Messages that have not been synchronized are not available without an internet connection. The default value is 1 week.
- In the Restrictions section, select or clear the following check boxes, if necessary:
- In the Signature and encryption section, configure the settings for signing and encrypting outgoing mail using the S/MIME protocol in the Mail app. S/MIME is a protocol for transmitting digitally signed encrypted messages. S/MIME provides cryptographic security capabilities such as authentication, message integrity control, and non-repudiation of origin (using digital signatures). The protocol also uses encryption to help improve the level of confidentiality and security of data in email messages.
- Sign messages
- Signing certificate for outgoing messages
- Encrypt messages by default
- Encryption certificate
- Show toggle button for encrypting selected messages
Display of the
icon in the Mail app in the To field for sending encrypted messages.If this check box is selected, the mobile device user can encrypt individual messages by clicking the icon.
If the check box is cleared, the icon for encrypting messages is not displayed. In this case, the Encrypt messages by default check box determines whether outgoing mail is encrypted.
- On the General settings tab, specify the user's data:
- Click Add.
The new Exchange ActiveSync account appears in the list.
You can modify or delete Exchange ActiveSync accounts in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, Exchange ActiveSync accounts from the compiled list are added on the user's mobile device.
Page topConfiguring an Exchange mailbox on Android devices
To work with corporate mail, contacts, and the calendar on the mobile device, you can configure the Exchange mailbox settings for the standard Samsung Email app.
An Exchange mailbox can be configured only for Samsung devices running Android 9 or earlier.
To configure an Exchange mailbox on a user's mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Samsung Knox settings section.
- On the Exchange ActiveSync card, click Settings.
The Exchange ActiveSync window opens.
- Enable the settings using the Exchange ActiveSync toggle switch.
- In the Server address field, enter the IP address or DNS name of the server hosting the mail server.
- In the Domain name field, enter the name of the mobile device user's domain on the corporate network.
- In the Synchronization interval drop-down list, select the interval for mobile device synchronization with the Microsoft Exchange server.
- To use the SSL (Secure Sockets Layer) data transport protocol, select the Use SSL connection check box. The SSL protocol uses encryption and certificate-based authentication for secure data transfer. This check box is selected by default.
- To use digital certificates to protect data transfer between the user's mobile device and the Microsoft Exchange server, select the Verify server certificate check box. The server certificate is verified to have been issued from the trusted root certificate. This check box is selected by default.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topConfiguring protection levels in Kaspersky Security Center
These settings apply to Android devices.
To configure rules for assigning protection levels in Kaspersky Security Center:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the KES for Android settings section.
- On the Severity settings for device protection level card, click Settings.
The Severity settings for device protection level window opens.
- Enable the settings using the Severity settings for device protection level toggle switch.
- Select the OK, Warning, or Critical protection level for each of the following conditions:
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
For more information about default values, reasons, and conditions for assigning protection levels, please refer to the Mobile device protection levels section.
Page topManaging app configurations
This section provides instructions on how to manage settings and edit configurations of the apps installed on your users' devices.
Managing Google Chrome settings
These settings apply to corporate devices and devices with a corporate container.
To configure Google Chrome settings:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the App configuration section.
- On the Google Chrome settings card, click Settings.
The Google Chrome settings window opens.
- Enable the settings using the Google Chrome settings toggle switch.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
- Configure the required settings.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Manage content settings
On the Content tab, you can manage the following settings:
- In the Cookies section:
- In the JavaScript section:
- In the Pop-ups section:
- In the Location tracking section:
Manage proxy settings
On the Proxy tab, you can manage the following settings:
Manage search settings
On the Search tab, you can manage the following settings:
- In the Touch to Search section:
- In the Search provider section:
Manage security settings
On the Security tab, you can manage the following settings:
- In the Google Safe Browsing and SafeSearch section:
- In the Blocked websites section:
- In the Passwords and autofill section:
- In the Network section:
Manage additional settings
On the Additional settings tab, you can manage the following settings:
- In the Bookmarks section:
- In the History and Incognito mode section:
- In the Other section:
Managing Exchange ActiveSync for Gmail
These settings apply to corporate devices and devices with a corporate container.
The Exchange ActiveSync settings let you manage Exchange ActiveSync for the Gmail app.
To configure Exchange ActiveSync settings:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the App configuration section.
- On the Exchange ActiveSync card, click Settings.
The Exchange ActiveSync window opens.
- Enable the settings using the Exchange ActiveSync toggle switch.
- Specify the Exchange ActiveSync settings:
- On the General settings tab, specify the following settings:
- Exchange ActiveSync server address
- Settings in the User credentials section:
- Device ID
A string used by a Kaspersky Security Center proxy or a third-party gateway to identify the device and connect it to Exchange ActiveSync. You can either enter a value or select a macro by clicking the
button. - User name
The user name that will be used to pull the user name from Microsoft Active Directory. It might be different from the user's email address. You can either enter a value or select a macro by clicking the
button. - Email address
The email address that will be used to pull the user's email address from Microsoft Active Directory. You can either enter a value or select a macro by clicking the
button.
- Device ID
- Settings in the Authentication section:
- On the Additional settings tab, specify the following settings:
- Settings in the Email synchronization section:
- Settings in the Restrictions section:
- Settings in the Signature section:
- On the General settings tab, specify the following settings:
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topConfiguring other apps
These settings apply to corporate devices and devices with a corporate container.
The Configure other apps settings let you configure installed apps that support configurations.
To add app configurations:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the App configuration section.
- On the Configure other apps card, click Settings.
The Configure other apps window opens.
- Enable the settings using the Configure other apps toggle switch.
- Click Add.
The Add app configuration window opens.
- In the Method for adding configuration drop-down list, select how to add configuration:
- In the Configuration data section, specify the following settings:
An example of configured basic parameters for the Microsoft Outlook app.
Microsoft Outlook app configuration
Configuration key
Description
Type
Value
Default value
com.microsoft.outlook.EmailProfile.EmailAccountNameUsername
String
The username that will be used to pull the username from Microsoft Active Directory. It might be different from the user's email address. You can either enter a value or select a macro by clicking the
button. For example, User.com.microsoft.outlook.EmailProfile.EmailAddressEmail address
String
The email address that will be used to pull the user's email address from Microsoft Active Directory. You can either enter a value or select a macro by clicking the
button. For example, user@companyname.com.com.microsoft.outlook.EmailProfile.EmailUPNUser Principal Name or username for the email profile that is used to authenticate the account
String
The name of the user in email address format. For example,
userupn@companyname.com.com.microsoft.outlook.EmailProfile.ServerAuthenticationAuthentication method
String
Username and Password– Prompts the device user for their password.Certificates– Certificate-based authentication.Username and Passwordcom.microsoft.outlook.EmailProfile.ServerHostNameActiveSync FQDN
String
The Exchange ActiveSync email server URL. You don't need to use
http://orhttps://in front of the URL. For example,mail.companyname.com.com.microsoft.outlook.EmailProfile.AccountDomainEmail domain
String
The account domain of the user. You can either enter a value or select a macro by clicking the
button. For example, companyname.com.microsoft.outlook.EmailProfile.AccountTypeAuthentication type
String
ModernAuth– Uses a token-based identity management method. Specify ModernAuth as the Account Type for Exchange Online.BasicAuth– Prompts the device user for their password. Specify BasicAuth as the Account Type for Exchange On-Premises.BasicAuth - Click the Add setting button to add a block of the app configuration settings. You can add several blocks of settings.
Specify the following parameters for each block of settings of the configuration:
For some types of settings, additional parameters can be configured. For example:
- You can add macros for a String.
- You can add a field to a Bundle.
- You can add a Bundle to a BundleArray.
It is also possible to edit a setting to be added to a BundleArray by clicking the Configure Bundle button and configuring the setting's parameters.
For information about configuring rules, please refer to the official documentation for the app to be configured.
- Click Add.
The configuration appears in the list of app configurations.
You can modify or delete app configurations in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
The app configuration is applied.
Some apps may not notify Kaspersky Endpoint Security for Android that the app configuration has been applied.
When configuring some apps, certificates installed on devices via Kaspersky Security Center can be used. In this case, you must specify a certificate alias in the app configuration:
VpnCertfor VPN certificates.MailCertfor mail certificates.SCEP_profile_namefor certificates received using SCEP.
Managing app permissions
These settings apply to corporate devices and devices with a corporate container.
App permission management settings let you configure rules for granting runtime permissions to installed apps.
To add app permissions:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the App configuration section.
- On the App permission management card, click Settings.
The App permission management window opens.
- Enable the settings using the App permission management toggle switch.
- Click Add.
The Add app with permission granting rules window opens.
- In the Method for adding configuration section, select how to add a configuration with permission granting rules:
- In the App data section, specify the following settings:
- Click the Add rule button to add and configure a new rule. You can add several permissions.
Select one of the following permissions.
To configure granting rules for app runtime permissions, you need to select one of the following actions for each permission:
You can save only one granting rule for each app permission.
- Click Add.
The configuration appears in the Apps with configured permission granting rules list.
You can modify or delete configurations in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
The configuration with permission granting rules is applied. Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Permission granting rules configured for specific apps have precedence over the general policy for granting permissions. For example, if you first select the Deny permissions automatically option in the Corporate container on devices section, and then select the Grant permissions automatically option for a specific app in the App permission management section, the permission for this app will be granted automatically.
Page topCreating a report on installed mobile apps
The Report on installed mobile apps lets you get detailed information about the apps installed on users' Android devices.
To allow the report to display information, the Send data on installed apps check box must be selected in App Control settings and the An app was installed or removed (list of installed apps) informational event type must be stored in the Administration Server database.
To enable sending data:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Security controls section.
- On the App Control card, click Settings.
The App Control window opens.
- In the Report on installed apps section, select the Send data on installed apps check box.
- If you want to receive data about system apps, select the Send data on built-in apps check box.
- If you want to receive data about service apps, which do not have an interface and cannot be opened by the user, select the Send data on service apps check box.
- Click OK.
- Click Save to save the changes you have made.
- Click the name of the policy and select Event configuration.
- Go to the Info section.
- Click the An app was installed or removed (list of installed apps) event to open its properties.
- In the event properties window, turn on the Store in the Administration Server database for (days) toggle switch and set the storage period. By default, the storage period is 30 days.
After the storage period expires, the Administration Server deletes outdated information from the database. For more information about events, please refer to the Kaspersky Security Center Help.
- Click OK.
- Click Save to save the changes you have made.
Sending data is enabled.
To configure a report on installed mobile apps:
- In the main window of Kaspersky Security Center Web Console, select Monitoring & reporting → Reports.
- Click the Report on installed mobile apps report template to open its properties.
- In the window that opens, click Edit.
- Edit the report template properties:
- On the General tab, specify the following parameters:
- On the Fields tab, select the fields that will be displayed in the report and the order of these fields, and configure whether the report must be sorted and filtered by each of the fields.
- Click Save to save the changes you have made.
The updated report template appears in the list of report templates.
To create and view a report on installed mobile apps:
- In the main window of Kaspersky Security Center Web Console, select Monitoring & reporting → Reports.
- Click a report with the Report on installed mobile apps type.
A report using the selected template is generated and displayed.
For more information about using reports, managing custom report templates, using report templates to generate new reports, and creating report delivery tasks, please refer to the Kaspersky Security Center Help.
Page topInstalling root certificates on Android devices
A root certificate is a public key certificate issued by a trusted certificate authority (CA). Root certificates are used to verify custom certificates and guarantee their identity.
Kaspersky Security Center Web Console lets you add root certificates to be installed to a trusted certificate store on Android devices.
These certificates are installed on user devices as follows:
- On corporate devices, the certificates are installed automatically.
If you delete a root certificate in the policy settings, it will also be automatically deleted on the device during the next synchronization with the Administration Server.
- On personal devices:
- If a corporate container was not created, the device user is prompted to install each certificate manually in a personal space by following the instructions in the notification.
- If a corporate container was created, the certificates are installed automatically to the container. If the Duplicate installation of root certificates in user's personal space check box is selected in the corporate container settings, the certificates can also be installed in a personal space. The device user is prompted to do this manually by following the instructions in the notification.
If you delete a root certificate in the policy settings, it will also be automatically deleted on the device during the next synchronization with the Administration Server.
For instructions on how to install certificates in a personal space, please refer to Installing root certificates on the device.
To add a root certificate:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Device configuration section.
- On the Root certificates card, click Settings.
The Root certificates window opens.
- Enable the settings using the Root certificates toggle switch.
- Click Add.
The file explorer opens.
- Select a certificate file (a CER, PEM, KEY, or CRT file) and click Open.
The certificate file must be no larger than 10 MB.
The certificate will appear in the list of root certificates.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are configured after the next device synchronization with Kaspersky Security Center.
Page topConfiguring notifications for Kaspersky Endpoint Security for Android
If you don't want the mobile device user to be distracted by Kaspersky Endpoint Security for Android notifications, you can disable certain notifications.
Kaspersky Endpoint Security for Android uses the following tools to display the status of device protection:
- Protection status notification. This notification is pinned to the notification bar. A protection status notification cannot be removed. The notification displays the device protection status (for example,
) and the number of issues, if any. You can tap the device protection status and see security issues in the app. - App notifications. These notifications inform the device user about the application (for example, the detection of a threat).
- Pop-up messages. Pop-up messages require action from the device user (for example, action to take when a threat is detected).
All Kaspersky Endpoint Security for Android notifications are enabled by default.
On Android 13, the device user must grant the permission to send notifications during or after the Initial Configuration Wizard.
The user can disable all notifications from Kaspersky Endpoint Security for Android in the settings on the notification bar. If notifications are disabled, the user is not monitoring operation of the app and may ignore important information (for example, information about failures during device synchronization with Kaspersky Security Center). In this case, to find out the app operating status, the user must open Kaspersky Endpoint Security for Android.
To configure displaying notifications about the operation of Kaspersky Endpoint Security for Android:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the KES for Android settings section.
- On the Notifications card, click Settings.
The Notifications window opens.
- Enable the settings using the Notifications toggle switch.
- If you want to hide all notifications and pop-up messages, in the Background notifications section, select the Disable notifications when Kaspersky Endpoint Security is in the background check box.
Kaspersky Endpoint Security for Android will display only the protection status notification. The notification displays the device protection status (for example,
) and the number of issues.In-app notifications (for example, when the user updates anti-malware databases manually) will still be displayed.
We recommend that you enable notifications and pop-up messages. If you disable notifications and pop-up messages when the app is in the background, the app will not warn users about threats in real time. In this case, mobile device users will not see the device protection status unless they open the app.
- In the Notifications about device security issues section, select the Kaspersky Endpoint Security for Android issues that you want to display on the user's mobile device.
Displaying certain Kaspersky Endpoint Security for Android issues is mandatory. These issues are always displayed on the device (for example, issues about license expiration).
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. The notifications that you disable will not be displayed on the user's mobile device.
Page topConnecting iOS MDM devices to AirPlay
Configure the connection to AirPlay devices to stream music, photos, and videos from an iOS MDM device to AirPlay devices. To be able to use AirPlay, the mobile device and AirPlay devices must be connected to the same wireless network. AirPlay devices include Apple TV devices (second generation or later), AirPort Express devices, speakers, TVs, and radios with AirPlay support.
Automatic connection to AirPlay devices is available for devices operating in basic control mode and for supervised devices.
To configure the connection of an iOS MDM device to AirPlay devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the AirPlay card, click Settings.
The AirPlay window opens.
- Enable the settings using the AirPlay toggle switch.
- In the Passwords section, click Add password.
- In the Device field, enter the name of the AirPlay device on the wireless network.
- In the Password field, enter the password to the AirPlay device.
- If you want iOS MDM devices to connect only to specific AirPlay devices, create a list of allowed devices in the Allowed devices section. To do this, click Add device and specify the MAC addresses of AirPlay devices.
Both the Wi-Fi and Ethernet address for each device must be added.
Access to AirPlay devices that are not in the list of allowed devices is blocked. If the list of allowed devices is empty, Kaspersky Mobile Devices Protection and Management allows access to all AirPlay devices.
- Click OK.
- Click Save to save the changes you have made.
As a result, once the policy is applied, the user's mobile device will automatically connect to AirPlay devices to stream media.
Page topConnecting iOS MDM devices to AirPrint
To enable printing documents from an iOS MDM device wirelessly using AirPrint, configure automatic connection to AirPrint printers. The mobile device and printer must be connected to the same wireless network. Shared access for all users must be configured on the AirPrint printer.
To configure the connection of an iOS MDM device to an AirPrint printer:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the AirPrint card, click Settings.
The AirPrint window opens.
- Enable the settings using the AirPrint toggle switch.
- Click Add.
The Add printer window opens.
- In the IP address or FQDN field, enter the IP address or a fully qualified domain name (FQDN) of the AirPrint printer.
- In the Port field, enter the listening port of the AirPrint destination.
- In the Resource path field, enter the path to the AirPrint printer.
The path to the printer corresponds to the rp (resource path) key of the Bonjour protocol. For example:
- printers/Canon_MG5300_series
- ipp/print
- Epson_IPP_Printer
- If you want to protect the connection to the AirPrint printer using the TLS protocol, select the Use TLS check box.
- Click Add.
The newly added AirPrint printer appears in the list.
- Click OK.
- Click Save to save the changes you have made.
As a result, once the policy is applied, the mobile device user can wirelessly print documents on the AirPrint printer.
Page topConfiguring the Access Point Name (APN)
This section provides instructions on how to connect a mobile device to cellular data services on a mobile network.
Configuring APN on Android devices (only Samsung)
APN can be configured only for Samsung devices.
A SIM card must be inserted to be able to use an access point on the user's mobile device. Access point settings are provided by the mobile operator. Incorrect access point settings may result in additional mobile charges.
To configure the Access Point Name (APN) settings on a user's mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Samsung Knox settings section.
- On the APN settings card, click Settings.
The APN settings window opens.
- Enable the settings using the APN settings toggle switch.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
- Specify the following access point settings for connecting the user to the data service:
- In the APN type drop-down list, select the type of access point (APN) for data transmission on a GPRS/3G/4G mobile network:
- Internet. Connection of the user's mobile device to the internet.
- MMS. Exchange of MMS multimedia messages.
- Internet and MMS. Connection to the internet and exchange of multimedia messages. This is the default value.
- In the APN name field, specify the name of the access point.
- In the MCC field, enter the mobile country code (MCC).
- In the MNC field, enter the mobile network code (MNC).
- In the APN type drop-down list, select the type of access point (APN) for data transmission on a GPRS/3G/4G mobile network:
- If you have selected MMS or Internet and MMS as the type of access point, specify the following additional MMS server settings in the MMS server section:
- In the MMS server name field, specify the full domain name of the mobile carrier's server used for MMS exchange (for example,
mms.mobile.com). - In the MMS proxy server address field, specify the network name or IP address of the proxy server.
- In the MMS proxy server port field, specify the port number of the mobile carrier's server used for MMS exchange.
- In the MMS server name field, specify the full domain name of the mobile carrier's server used for MMS exchange (for example,
- In the Authentication section, specify the authentication settings:
- In the Authentication type drop-down list, select the type of authentication of the mobile device user that will be used on the mobile carrier's server for network access. By default, user authentication is not required. The following types are available:
- None. User authentication is not required to access the mobile network.
- PAP (Password Authentication Protocol). An authentication protocol that uses passwords as plain non-encrypted text.
- CHAP (Challenge Handshake Authentication Protocol). A request-response authentication protocol that uses standard MD5 hashing to encrypt the response.
- Concurrently. Combined use of CHAP and PAP protocols.
- In the User name field, enter the user name for authorization on the mobile network.
- In the Password field, enter the password for user authorization on the mobile network.
- In the Authentication type drop-down list, select the type of authentication of the mobile device user that will be used on the mobile carrier's server for network access. By default, user authentication is not required. The following types are available:
- In the Network section, specify the following network settings:
- In the Network name field, enter the name of the network.
- In the Server address field, specify the network name of the mobile carrier's server through which data transmission services are accessed.
- In the Proxy server section, specify the following proxy server settings:
- Select the Use a proxy server check box to enable the use of a proxy server. This check box is cleared by default.
- In the Proxy server address field, specify the network name or IP address of the mobile carrier's proxy server for network access. This field is available only if the Use a proxy server check box is selected.
- In the Proxy server port field, specify the port number of the mobile carrier's proxy server for network access. This field is available only if the Use a proxy server check box is selected.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.
Page topConfiguring APN on iOS MDM devices
The Access Point Name (APN) has to be configured in order to enable the mobile network data transmission service on the user's iOS MDM device.
To configure an access point on a user's iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the APN settings card, click Settings.
The APN settings window opens.
- Enable the settings using the APN settings toggle switch.
The toggle switch in this card does not enable or disable the corresponding functionality on devices. Enabling the toggle switch lets you configure custom settings. Disabling the toggle switch lets you use default settings.
- In the APN type drop-down list, select the type of access point for data transfer on a GPRS/3G/4G mobile network:
- Built-in APN. Configure cellular communication settings for data transfer via a mobile network operator that supports operation with a built-in Apple SIM. For more details about devices with a built-in Apple SIM, visit the Apple Support website.
- APN. Configure cellular communication settings for data transfer via the mobile network operator of the inserted SIM card.
- Built-in APN and APN. Configure cellular communication settings for data transfer via the mobile network operators of the inserted SIM card and the built-in Apple SIM. For more details about devices with a built-in Apple SIM and a SIM card slot, visit the Apple Support website.
- If you selected APN, in the APN section click Add.
The Add APN window opens.
- Configure the following settings:
- In the APN name field, specify the name of the access point.
- In the Authentication type drop-down list, select the type of user authentication on the mobile operator's server for network access (internet and MMS).
- In the User name field, enter the user name for authorization on the mobile network.
- In the Password field, enter the password for user authorization on the mobile network.
- In the Proxy server address field, enter the name of the host or the IP address of the proxy server.
- In the Proxy server port field, enter the number of the proxy server port.
- In the Allowed protocol drop-down list, select the internet protocol.
- In the Allowed protocol for roaming drop-down list, select the internet protocol that will be used during international roaming.
- In the Allowed protocol for domestic roaming drop-down list, select the internet protocol that will be used during domestic roaming.
- If you want devices on IPv6-only networks to be able to access IPv4-only internet services, select the Use the 464XLAT technology check box.
- Click OK.
- If you selected Built-in APN, configure the following settings:
- In the Built-in APN name field, specify the name of the access point.
- In the Authentication type drop-down list, select the type of user authentication on the mobile operator's server for network access (internet and MMS).
- In the User name field, enter the user name for authorization on the mobile network.
- In the Password field, enter the password for user authorization on the mobile network.
- In the Allowed protocol drop-down list, select the internet protocol.
- Click OK.
- Click Save to save the changes you have made.
As a result, the access point name (APN) is configured on the user's mobile device after the policy is applied.
Page topCorporate container
This section contains information about working with a corporate container.
About corporate containers
Android Enterprise is a platform for managing the corporate mobile infrastructure and provides company employees with a safe work environment in which they can use mobile devices. For details on using Android Enterprise, see the Google support website.
You can create a corporate container that uses an Android Work Profile on a user's personal mobile device. A corporate container is a safe environment in which the administrator can manage apps and user accounts without restricting the user's use of their own data. When a corporate container is created on the user's mobile device, the following corporate apps are automatically installed in it: Google Play, Google Chrome, Downloads, Kaspersky Endpoint Security for Android, and others. Apps installed in the corporate container as well as notifications from these apps are marked with a briefcase icon. You have to create a separate Google corporate account for the Google Play app. Apps installed in a corporate container appear in the common list of apps.
Page topConfiguring a corporate container
To configure the settings of a corporate container:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Corporate container section.
- On the Corporate container on devices card, click Settings.
The Corporate container on devices window opens.
- Enable the settings using the Corporate container on devices toggle switch.
- Specify the corporate container settings:
- On the General tab, you can specify the settings for data sharing, contacts, and more.
- Settings in the Data access and sharing section:
- Prohibit personal apps from sharing data with corporate container apps
- Prohibit corporate container apps from sharing data with personal apps
- Prohibit corporate container apps from accessing personal files
- Prohibit personal apps from accessing files in corporate container
- Prohibit use of clipboard between personal apps and corporate container
- Prohibit activation of USB debugging
- Prohibit users from adding and removing accounts in corporate container
- Prohibit screen sharing, recording, and screenshots in corporate container apps
- Settings in the Contacts section:
- Settings in the Data access and sharing section:
- On the Apps tab, specify the following settings:
- Settings in the General section:
- Enable App Control in corporate container only
- Enable Web Protection and Web Control in corporate container only
- Prohibit installation of apps from unknown sources in corporate container
- Prohibit removing apps from corporate container
- Prohibit displaying notifications from corporate container apps when screen is locked
- Prohibit use of camera for corporate container apps
- In the Granting runtime permissions for corporate container apps section you can select an action to be performed when corporate container apps are running and request additional permissions. This does not apply to permissions granted in the device settings (for example, Access All Files).
- In the Adding widgets of corporate container apps to device home screen section you can choose whether the device user is allowed to add widgets of corporate container apps to the device home screen.
- Settings in the General section:
- On the Certificates tab, you can configure the following settings:
- On the Password tab, specify the corporate container password settings:
- Require setting a password for corporate container
- Minimum password length
- Minimum password complexity requirements
- Maximum number of failed password attempts before corporate container is deleted
- Maximum password lifetime (days)
- Number of days to send a notification before a required password change
- Number of recent passwords that cannot be set as a new password
- Period of inactivity before corporate container is locked (sec)
- Period after biometric unlock before password must be entered (min)
- Allow biometric unlock methods
- Allow fingerprint unlock
- Allow face unlock
- Allow iris scanning
- On the Passcode tab, specify the one-time passcode settings. The user will be prompted to enter the one-time passcode to unlock their corporate container if it is locked.
- On the General tab, you can specify the settings for data sharing, contacts, and more.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with Kaspersky Security Center. The user's mobile device is divided into a corporate container and a personal space.
Page topUnlocking the corporate container
The corporate container can be locked if the device does not meet the Compliance Control security requirements.
To unlock the corporate container, the user of the mobile device must enter a one-time corporate container passcode on the locked screen. The passcode is generated by Kaspersky Security Center and is unique for each mobile device. When the corporate container is unlocked, the corporate container password is set to the default value (1234).
As an administrator, you can view the passcode in the policy settings that are applied to the mobile device. The length of the passcode can be changed (4, 8, 12, or 16 digits) in the Corporate container on devices settings of the policy.
To unlock a corporate container using a one-time passcode:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- Click the mobile device for which you want to get a one-time passcode.
- Select Applications → Kaspersky Mobile Devices Protection and Management.
The Kaspersky Mobile Devices Protection and Management properties window opens.
- Select the Application settings tab.
The unique passcode for the selected device is shown in the One-time code field of the One-time corporate container passcode section.
- Use any available method (such as email) to communicate the one-time passcode to the user.
The user then must enter the received one-time passcode on their device.
The corporate container of the user's mobile device is unlocked.
After the corporate container on a device is locked, the history of corporate container passwords is cleared. This means that the user can specify a recent password, regardless of the corporate container password settings.
Page topAdding an LDAP account
These settings apply to supervised devices and devices operating in basic control mode.
To enable an iOS MDM device user to access corporate contacts on the LDAP server, add an LDAP account.
To add an LDAP account of an iOS MDM device user:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the LDAP card, click Settings.
The LDAP window opens.
- Enable the settings using the LDAP toggle switch.
- Click Add.
The Add LDAP account window opens.
- On the General settings tab. specify the following LDAP settings:
- In the Server section, specify the server settings:
- In the Description field, enter a description of the user's LDAP account. You can either enter a value or select a macro by clicking the button.
- In the Server address field, enter the name of the LDAP server domain.
- In the Description field, enter a description of the user's LDAP account. You can either enter a value or select a macro by clicking the
- In the Authentication section, specify the user's credentials:
- In the Account name field, enter the account name for authorization on the LDAP server. You can either enter a value or select a macro by clicking the button.
- In the Password field, enter the password of the LDAP account for authorization on the LDAP server.
- To use the SSL (Secure Sockets Layer) data transport protocol to secure the transmission of messages, select the Use SSL connection check box.
- In the Account name field, enter the account name for authorization on the LDAP server. You can either enter a value or select a macro by clicking the
- If necessary, in the Per App VPN section, configure Per App VPN.
- In the Server section, specify the server settings:
- On the Search settings tab, compile a list of search queries for the iOS MDM device user to access corporate data on the LDAP server:
- Click the Add setting button to add a block of the search query settings.
- In the Name field, enter the name of a search query.
- In the Search scope drop-down list, select the nesting level of the folder for searching corporate data on the LDAP server:
- Root folder of the LDAP server. Search in the base folder of the LDAP server.
- First level subfolders. Search in folders in the first nesting level, counting from the base folder.
- All subfolders. Search in folders in all nesting levels, counting from the base folder.
- In the Search base field, enter the path to the folder on the LDAP server where the search begins (for example: "ou=people", "o=example corp").
- Repeat steps a-d for all search queries that you want to add to the iOS MDM device.
- Click Add.
The new LDAP account appears in the list.
You can modify or delete LDAP accounts in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, LDAP accounts from the compiled list is added on the user's mobile device. The user can access corporate contacts in the standard iOS apps: Contacts, Messages, and Mail.
Page topAdding a contacts account
These settings apply to supervised devices and devices operating in basic control mode.
To let the iOS MDM device user synchronize data with the CardDAV server, add a CardDAV account. Synchronization with the CardDAV server lets the user access the contact details from any device.
To add a CardDAV account of an iOS MDM device user:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Contacts card, click Settings.
The Contacts window opens.
- Enable the settings using the Contacts toggle switch.
- Click Add.
The Add CardDAV account window opens.
- In the Server section, in the Description field, enter a description of the user's CardDAV account.
- In the Server address and Server port fields, enter the host name or the IP address of the CardDAV server and the number of the CardDAV server port.
- In the Contact URL field, specify the URL of the CardDAV account of the iOS MDM device user on the CardDAV server (for example:
http://example.com/carddav/users/mycompany/user).The URL must begin with
http://orhttps://. - In the Authentication section, in the Account name field, enter the account name for authorization on the CardDAV server.
- In the Password field, enter the CardDAV account password for authorization on the CardDAV server.
- If you want to use the SSL (Secure Sockets Layer) data transport protocol to secure the transmission of data between the CardDAV server and the mobile device, select the Use SSL connection check box.
- If necessary, in the Per App VPN section, configure Per App VPN.
- Click Add.
The new CardDAV account appears in the list.
You can modify or delete CardDAV accounts in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, CardDAV accounts from the compiled list will be added on the user's mobile device.
If you experience problems when adding or updating accounts, check whether the settings you configured are correct.
Page topAdding a calendar account
To let an iOS MDM device user access their calendar events on a CalDAV server, add a CalDAV account. Synchronization with the CalDAV server lets the user create and receive invitations, receive event updates, and synchronize tasks with the Reminders app.
To add an iOS MDM device user's CalDAV account:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Calendar card, click Settings.
The Calendar window opens.
- Enable the settings using the Calendar toggle switch.
- Click Add.
The Add CalDAV account window opens.
- In the Server section, in the Description field, enter a description of the user's CalDAV account.
- In the Server address and Server port fields, enter the host name or the IP address of a CalDAV server and the number of the CalDAV server port.
- In the Calendar URL field, specify the URL of the CalDAV account of the iOS MDM device user on the CalDAV server (for example, http://example.com/caldav/users/mycompany/user).
The URL must begin with
http://orhttps://. - In the Authentication section, in the Account name field, enter the account name for authorization on the CalDAV server.
- In the Password field, set the CalDAV account password for authorization on the CalDAV server.
- If you want to use the SSL (Secure Sockets Layer) data transport protocol to secure transmission of event data between the CalDAV server and the mobile device, select the Use SSL connection check box.
- If necessary, in the Per App VPN section, configure Per App VPN.
- Click Add.
The new CalDAV account appears in the list.
You can modify or delete CalDAV accounts in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, CalDAV accounts from the compiled list is added on the user's mobile device.
If you experience problems when adding or updating accounts, check whether the settings you configured are correct.
Page topConfiguring a calendar subscription
These settings apply to supervised devices and devices operating in basic control mode.
To let the iOS MDM device user add events of shared calendars (such as a corporate calendar) to the user's calendar, add a subscription to these calendars. Shared calendars are calendars of other users who have a CalDAV account, iCal calendars, and other published calendars.
To add a calendar subscription:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Calendar subscriptions card, click Settings.
The Calendar subscriptions window opens.
- Enable the settings using the Calendar subscriptions toggle switch.
- Click Add.
The Add calendar subscription window opens.
- In the Description field, enter a description of the calendar subscription.
- In the Server address field, specify the URL of a third-party calendar.
In this field, you can enter the mail URL of the CalDAV account of a user whose calendar you are subscribing to. You can also specify the URL of an iCal calendar or a different published calendar.
- In the User name field, enter the user account name for authentication on the server of the third-party calendar.
- In the Password field, enter the calendar subscription password for authentication on the server of the third-party calendar.
- If you want to use the SSL (Secure Sockets Layer) data transport protocol to secure the transmission of event data between the CalDAV server and the mobile device, select the Use SSL connection check box.
- If necessary, in the Per App VPN section, configure Per App VPN.
- Click Add.
The new calendar subscription appears in the list.
You can modify or delete calendar subscriptions in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, events from the shared calendar in the list will be added to the calendar on the user's mobile device.
Page topConfiguring SSO
These settings apply to supervised devices and devices operating in basic control mode.
The SSO settings let you configure account settings for using Single Sign-On technology. Single Sign-On (SSO) is an authentication method that allows a user to sign in to multiple services with a single ID. The Kerberos protocol is used for user authentication.
To configure the use of SSO on iOS MDM devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the SSO card, click Settings.
The SSO window opens.
- Enable the settings using the SSO toggle switch.
- Specify the following settings:
- In the Account name field, specify the name of the user's Single Sign-On account for Kerberos server authorization. You can either enter a value or select a macro by clicking the button.
- In the Authentication section, specify the authentication settings:
- Kerberos user name
Main name of the account of an iOS MDM device user on the Kerberos server. The Kerberos user name is case-sensitive and must be specified in the format
<primary>/<instance>, where:1.
<primary>is the user name.2.
<instance>is a description of the primary name, such as "admin". The instance may be omitted.Example: if the Kerberos user name is
mycompany/admin@EXAMPLE.COMormycompany@EXAMPLE.COM, you must entermycompany/adminormycompanyrespectively,You can either enter a value or select a macro by clicking the
button.Do not use the at sign (@) in this field. Otherwise the SSO profile will not be applied on the device.
- Kerberos scope
- Authentication certificate
- Kerberos user name
- In the URL prefixes section, specify the addresses of websites on which Kaspersky Mobile Devices Protection and Management allows using SSO:
- In the Bundle IDs section, specify the IDs of apps in which Kaspersky Mobile Devices Protection and Management allows using SSO:
- In the Account name field, specify the name of the user's Single Sign-On account for Kerberos server authorization. You can either enter a value or select a macro by clicking the
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, SSO is configured on the iOS MDM device.
Page topManaging Web Clips
A Web Clip is an app that opens a website from the home screen of a mobile device. By clicking Web Clip icons on the home screen of the device, the user can quickly open websites (such as the corporate website). Web Clips may also pop-up if the user taps and holds the Kaspersky Endpoint Security for Android app icon.
You can add or delete Web Clips on user devices and specify icons displayed on the screen. Web Clips can be added on both Android and iOS MDM devices.
Managing Web Clips on Android devices
To manage Web Clips on a user's Android device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Device configuration section.
- On the Web Clips card, click Settings.
The Web Clips window opens.
- Enable the settings using the Web Clips toggle switch.
- Click Add.
The Add Web Clip window opens.
- In the Web Clip name field, enter the name of the Web Clip to be displayed on the home screen of the Android device.
- In the Website URL field, enter the web address of the website that will open when the user taps the Web Clip icon. The address should begin with
http://orhttps://.If the entered website is forbidden or is not on the list of allowed websites in the Web Control settings of the policy, users will not be able to access this website via the Web Clip.
- Click Select to specify the image for the Web Clip icon. The PNG, JPEG, and ICO file formats are supported. If you do not select an image for the Web Clip, a blank square is displayed as the icon.
- Click Add.
The new Web Clip appears in the list.
You can modify or delete Web Clips in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Once the policy is applied to a device, the Kaspersky Endpoint Security for Android app shows notifications to prompt the user to install the Web Clips you created. After the user installs these Web Clips, the corresponding icons are added on the home screen of the device.
If there is no in-app notifications prompting the user to install Web Clips, make sure the Device has not been synchronized with the Administration Server for a long time check box is selected in the Notifications settings of the KES for Android settings section.
The deleted Web Clips are disabled on the home screen of the Android device. If the user taps the corresponding icon, a notification appears that the Web Clip is no longer available. The user should delete the Web Clip from the home screen by following a vendor-specific procedure.
Managing Web Clips on iOS MDM devices
By default, the following restrictions apply to Web Clips:
- The user cannot manually remove Web Clips from the mobile device.
- The corner rounding, shadow, and gloss visual effects are applied to the Web Clip icon on the screen.
- Websites that open when the user taps a Web Clip icon do not open in full-screen mode.
To manage Web Clips on a user's iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Web Clips card, click Settings.
The Web Clips window opens.
- Enable the settings using the Web Clips toggle switch.
- Click Add.
The Add Web Clip window opens.
- In the Web Clip name field, enter the name of the Web Clip to be displayed on the home screen of the iOS MDM device.
- In the Website URL field, enter the web address of the website that will open when the user taps the Web Clip icon. The address should begin with
http://orhttps://.If the entered website is forbidden or is not on the list of allowed websites in the Web Control settings of the policy, users will not be able to access this website via the Web Clip.
- Click Select to specify the image for the Web Clip icon.
The image must meet the following requirements:
- Image size no greater than 400 х 400 pixels.
- File format: PNG, JPEG, or ICO.
- File size no larger than 1 MB.
If you do not select an image for the Web Clip, a blank square is displayed as the icon.
If the selected image has a transparent background, the background will be black on the device.
- In the Options section, specify the following additional settings:
- If you want to allow the user to remove the Web Clip from the iOS MDM device, select the Allow removal of Web Clip check box.
- If you want the Web Clip icon to be displayed without special visual effects (rounding of icon corners and gloss effect), select the Precomposed icon check box.
- If you want the website to open in full-screen mode on the iOS MDM device when the user taps the icon, select the Full screen Web Clip check box.
In full-screen mode, the Safari toolbar is hidden and only the website is shown on the device screen.
- Click Add.
The new Web Clip appears in the list.
You can modify or delete Web Clips in the list using the Edit and Delete buttons at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Once the policy is applied, the Web Clip icons in the list you have created are added on the home screen of the user's mobile device.
The deleted Web Clips are removed from the home screen of the iOS MDM device.
Page topSetting a wallpaper
You can set an image as the home screen wallpaper and lock screen wallpaper on users' devices that fall under the same policy.
To set a wallpaper on users' Android devices:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select Android and go to the Device configuration section.
- On the Custom wallpapers card, click Settings.
The Custom wallpapers window opens.
- Enable the settings using the Custom wallpapers toggle switch.
- In the Home screen wallpaper section, in the How to set wallpaper drop-down list, select the method for specifying the wallpaper:
- Add an image to be used as a wallpaper:
- If you selected the Upload file option, click Select to upload an image. When the upload is finished, an image preview will be displayed.
- If you selected the Download image from the internet option, specify the link to the image in the Link to image field. You can click Open preview to view the image in a new browser tab.
- If you want to use the same image as the lock screen wallpaper, in the Lock screen wallpaper section, select the Use home screen wallpaper for lock screen check box.
- Click OK.
- Click Save to save the changes you have made.
The imported image is set as a wallpaper on users' devices.
Page topAdding fonts
These settings apply to supervised devices and devices operating in basic control mode.
To add a font on a user's iOS MDM device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
- In the policy properties window, select Application settings.
- Select iOS and go to the Device configuration section.
- On the Custom fonts card, click Settings.
The Custom fonts window opens.
- Enable the settings using the Custom fonts toggle switch.
- Click Add.
- Select the font file saved on your computer. The file must have the .TTF or .OTF extension.
Fonts with the .TTC or .OTC extension are not supported.
Fonts are identified using the PostScript name. Do not install fonts with the same PostScript name even if their content is different. Installing fonts with the same PostScript name will result in an error.
- Click Open.
The new font appears in the list.
You can delete fonts in the list using the Delete button at the top of the list.
- Click OK.
- Click Save to save the changes you have made.
Mobile device settings are changed after the next device synchronization with the iOS MDM Server.
As a result, once the policy is applied, the user will be prompted to install fonts from the list that has been created.
Page topWorking with commands for mobile devices
This section contains information about commands for managing mobile devices supported by Kaspersky Security Center. It provides instructions on how to send commands to mobile devices, as well as how to view the execution statuses of commands in the command history.
Commands for mobile devices
Kaspersky Security Center supports commands for remote mobile device management. For instance, if a mobile device is lost or stolen, you can send commands to locate the device or wipe all corporate data from the device.
You can send commands to the following types of managed mobile devices:
- Android devices managed via the Kaspersky Endpoint Security for Android app
- iOS MDM devices
Each device type supports a dedicated set of commands.
You can cancel commands in the Command history.
Commands may be delivered almost immediately to devices connected to the internet. As a result, they may fail to cancel despite being displayed as canceled.
Commands for Android devices
Command |
Result |
|
|---|---|---|
Lock device |
The mobile device is locked. To obtain access to data, you must unlock the device using the Unlock device command or a one-time passcode. |
|
Unlock device |
The mobile device is unlocked. After unlocking a device running Android 5 – 6, the screen unlock password is reset to "1234". After unlocking a device running Android 7 or later, the screen unlock password is not changed. |
|
Reset to factory settings |
All data is deleted from the mobile device and the settings are rolled back to their factory values. After this command is executed, the device will not be able to receive or execute subsequent commands. This command is unavailable for personal devices and devices with a corporate container running Android 14 or later. |
|
Wipe corporate data |
Corporate data is wiped from the device. The list of wiped data depends on the mode the device is operating in:
|
|
Synchronize device |
The mobile device data is synchronized with the Administration Server. The Executed status may be displayed when the command has been successfully sent but not yet received by the device. |
|
Locate device |
The mobile device's location coordinates are obtained. To view the device location on a map, go to the Assets (Devices) → Mobile → Devices section. Then choose a device and select Command history → Locate device → Device coordinates → Open Maps. On devices running Android 12 or later, if the user granted the "Use approximate location" permission, the Kaspersky Endpoint Security for Android app first tries to get the precise device location. If this is not successful, the approximate device location is returned only if it was received within the past 30 minutes. Otherwise, the command fails. This command does not work on Android devices if Google Location Accuracy is disabled in the settings. Please be aware that not all Android devices come with this location setting. |
|
Take photos |
The mobile device is locked. Photos are taken using the front camera of the device when somebody attempts to unlock the device. On devices with a pop-up front camera, the photo will be black if the camera is stowed. When attempting to unlock the device, the user automatically consents to having their photo taken on the device. If the permission to use the camera has been revoked, the mobile device displays a notification and prompts to provide the permission. On a mobile device running Android 12 or later, if the permission to use the camera has been revoked via Quick Settings, the notification is not displayed but the taken photo is black. |
|
Sound alarm |
The mobile device sounds an alarm. The alarm is sounded for 5 minutes (or for 1 minute if the device battery is low). |
|
Wipe app data |
The data of a specified app is wiped from the mobile device. For this action, you need to specify the package name for the app whose data is to be deleted. |
|
Wipe data of all apps |
The data of all apps is wiped from the mobile device. On a corporate device, the data of all apps on the device is wiped. |
|
Send message |
A message with the specified title and text is sent to the user's mobile device. You can send only a push notification or both a push notification and an alert. |
|
Get location history |
The mobile device's location history for the last 14 days is displayed. To view the device location on a map, go to the Assets (Devices) → Mobile → Devices section. Then choose a device and select Command history → Get location history → View on map. Due to technical limitations on Android devices, the device location may be retrieved less often than specified in the Location tracking settings. |
|
Commands for iOS MDM devices
Command |
Result |
|---|---|
Lock device |
The mobile device is locked. To access data, you must unlock the device. |
Reset unlock password |
The mobile device's screen unlock password is reset, and the user is prompted to set a new password in accordance with policy requirements. |
Reset to factory settings |
All data is deleted from the mobile device and the settings are rolled back to their factory values. After this command is executed, the device will not be able to receive or execute subsequent commands. |
Wipe corporate data |
All installed configuration profiles, the device management profile, and apps for which the Remove when device management profile is deleted check box has been selected are removed from the device. |
Synchronize device |
The mobile device data is synchronized with the Administration Server. |
Install configuration profile |
A configuration profile is installed on the mobile device. You cannot install a configuration profile with settings for a supervised device on a device in basic control mode. |
Delete configuration profile |
The configuration profile is deleted from the mobile device. The profile may be displayed in the list of configuration profiles installed on the device for several minutes after it has been deleted. |
Install app |
The specified app is installed on the mobile device. |
Update app |
The specified app is updated on the mobile device. |
Delete app |
The specified app is removed from the mobile device. |
OS update (supervised only) |
Operating system updates are scheduled on the mobile device according to the specified update settings. This command may fail to be executed when a device does not have enough storage space or the specified OS version is not available for the selected device. We recommend specifying the latest available OS version. |
Change roaming settings |
Data roaming and voice roaming are enabled or disabled. |
Set Bluetooth state (supervised only) |
Bluetooth is enabled or disabled on the mobile device. This command is supported only for supervised devices running iOS 11.3 or later. |
Enable Lost Mode (supervised only) |
Lost Mode is enabled on the supervised mobile device, and the device is locked. The device screen shows a message and phone number that you can edit. If you send the Enable Lost Mode command to a supervised iOS MDM device without a SIM card and this device is restarted, the device won't be able to connect to Wi-Fi and receive the Disable Lost Mode command. This is a specific feature of iOS devices. To avoid this issue, you can either send the command only to devices with a SIM card, or insert a SIM card into the locked device to allow it to receive the Disable Lost Mode command over the mobile network. |
Locate device (Lost Mode only) |
The location of the mobile device is obtained. |
Sound alarm (Lost Mode only) |
A sound is played on the lost mobile device. |
Disable Lost Mode (supervised only) |
Lost Mode is disabled on the mobile device, and the device is unlocked. |
Permissions for executing commands
Special rights and permissions are required for executing Kaspersky Endpoint Security for Android commands. When the Initial Configuration Wizard is running, Kaspersky Endpoint Security for Android prompts the user to grant the application all required rights and permissions. The user can skip these steps or later disable these permissions in the device settings. If this is the case, it will be impossible to execute commands.
On devices running Android 10 or later, the user must grant the "All the time" permission to access the location. On devices running Android 11 or later, the user must also grant the "While using the app" permission to access the camera. Otherwise, Anti-Theft commands will not function. The user will be notified of this limitation and will again be prompted to grant the required level of permissions. If the user selects the "Only this time" option for the camera permission, access is considered granted by the app. We recommend contacting the user directly if the Camera permission is requested again.
Page topSending commands
To send a command to the user's mobile device:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of devices that opens, select a device that you want to send a command to.
You can select multiple devices.
- Click Send command.
- In the Send command window that opens, in the Command field, select a command.
- Configure the command that you want to send.
- Click Send.
You can view and cancel commands in the Command history.
The command is sent to the devices you selected.
Page topViewing the statuses of commands in the command history
The application saves information about all commands that have been sent to mobile devices to the command history. The command history contains information about the time and date that each command was sent to the mobile device, their statuses, and descriptions of the results. For example, when a command fails, the history displays the cause of the error.
Commands sent to mobile devices can have the following statuses:
- Sent
The command has been sent to the mobile device.
- Executed
Execution of the command has succeeded.
- Error
Execution of the command failed.
- Canceling
The command is being removed from the queue of commands sent to the mobile device.
- Canceled
The command has been successfully removed from the queue of commands sent to the mobile device.
The application maintains a command history for each mobile device.
To view the command history:
- In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
- In the list of mobile devices, select the one for which you want to view the command history.
- Click Command history.
The Command history window opens. The sections of the Command history window correspond to the commands that can be sent to the mobile device.
- Select sections containing the necessary commands and view information about how the commands are sent and executed.