Get Started: Mobile Device Trust

Overview

黑料海角91入口 Mobile Device Trust brings 黑料海角91入口 Go鈩� to mobile devices and enables seamless, secure access to 黑料海角91入口-protected resources on the go. Using the 黑料海角91入口 Protect庐 mobile app, users register their device with 黑料海角91入口 Go, enabling biometric, passwordless verification when accessing protected resources.

When you create Conditional Access Policies in combination with 黑料海角91入口 Go for Mobile, you enforce Device Trust. This protects your company鈥檚 resources by ensuring users can access them only on trusted devices. Using a combination of 黑料海角91入口 Device Management, 黑料海角91入口 Go, 黑料海角91入口 Protect, and Conditional Access Policies (CAPs), you can safeguard access to both the 黑料海角91入口 User Portal and individual SSO apps.

Mobile devices can be trusted when they are enrolled in 黑料海角91入口 Device Management, have the 黑料海角91入口 Protect app deployed using Software Management, and are registered with 黑料海角91入口 Go. After registration, users verify their identity using 黑料海角91入口 Go for Mobile and biometrics on their device.

Note:

You can take advantage of 黑料海角91入口 Go for Mobile without enforcing device trust. By configuring the necessary prerequisites without creating CAPs, users can register their devices with 黑料海角91入口 Protect and use 黑料海角91入口 Go for seamless access to the User Portal and SSO apps.
When you enforce CAPs, users on devices that don鈥檛 meet the minimum criteria will not be able to access the protected resources.

Important:

See Understand Device Trust Readiness to learn how to configure your org as an admin to use Mobile Device Trust.
See Users: Configure Mobile Device Trust on Apple and Android Devices to learn how users can prepare their mobile devices and access resources.

Prerequisites

黑料海角91入口 Go for Mobile

黑料海角91入口 Go is enabled for your org. See Get Started: 黑料海角91入口 Go to learn more.
Device Management is enabled for your org:
- For Apple devices, see Set up Apple MDM to learn more.
- For Android devices, see Set Up Android EMM to learn more.
Mobile devices are enrolled in 黑料海角91入口 Device Management:
- Apple devices are enrolled in Apple MDM with the following supported enrollment types:
  - Automated Device Enrollment (ADE).
  - Profile-driven Device Enrollment.
  - Profile-driven User Enrollment.
- Android devices are enrolled in Android EMM with the following supported enrollment types:
  - Work Profile (Personal device).
  - Work Profile (Company-owned device).
  - Fully managed device.
  - Dedicated device.
Users are bound to their devices in 黑料海角91入口, otherwise the 黑料海角91入口 Go for Mobile registration process will fail.
- Company-owned devices using Android Zero Touch, Apple Automated Device Enrollment (ADE), or Admin Portal enrollments require you to bind the user to the mobile device record in 黑料海角91入口. See Bind Users to Devices to learn more.
- BYOD devices using User Enrollment for iOS or Work Profile for Android automatically bind the user to the device during enrollment if initiated via the User Portal.
  - BYOD/User Enrolled Apple devices require Managed Apple IDs (MAIDs) to enroll in MDM.
Apple VPP and/or Software Management for Android are enabled for your org to deploy the managed 黑料海角91入口 Protect app (v2.2.2+) to user devices:
- For Apple devices, see Manage Software with Apple鈥檚 VPP to learn more.
- For Android devices, Software Management is enabled automatically after configuring Android EMM. See Software Management: Android to learn more.

Note:

Devices without the 黑料海角91入口 Protect app will not be able to use 黑料海角91入口 Go for Mobile or access resources protected by Device Trust.

Device Trust

Conditional Access Policies (CAPs) are configured for each resource that you want to protect using the Device Management condition.
- Optionally, use Operating System conditions for granular control of device types. See Configure a Conditional Access Policy to learn more.

Note:

On mobile devices (iOS/Android), Device Trust is established using 黑料海角91入口 Go via the 黑料海角91入口 Protect app.
On desktop devices (macOS, Windows, Linux) Device Trust can be established using either 黑料海角91入口 Go or Device Trust Certificates for Desktop. See Manage Device Trust Certificates for Desktop to learn more.
- CAPs using the Device Management condition are evaluated based on the platform of the device requesting access.

Android MDT Requirements

Before you enroll in Android Mobile Device Trust (MDT), ensure your device meets the minimum version requirements for both the Android OS and 黑料海角91入口 Protect application to effectively enhance your security posture with MDT.

Important:

Android devices enrolled in MDT will have a persistent, system-mandated background notification enabled for 黑料海角91入口 Go.

Minimum Version Requirements

Android OS: version 12 or higher

黑料海角91入口 Protect application: 聽version 2.2.10 or higher

Note:

Android MDT enrollment requires Android OS versions 12 or higher to maintain strong security standards.

Considerations

Persistent background notifications
- In the work profile on the managed Android device, there will be a persistent background notification running for 黑料海角91入口 Go in the Android message drawer.
- These background notifications are required to enable the continuous operation and total transparency of 黑料海角91入口鈥檚 background activities on your device.
Android MDT vs. Android EMM
- Android Mobile Device Trust (MDT) focuses on establishing your device's security posture and granting access. To maintain security standards, enrolling in Android MDT requires Android OS versions 12 or higher.
- Android Enterprise Mobility Management (EMM) focuses on mobility management, including mobile device management (MDM). Android EMM can be used with Android OS versions 5.1 and higher.

Enforcing Device Trust

When you configure CAPs to enforce Mobile Device Trust, users can鈥檛 access protected resources on untrusted devices. When users first access a protected resource on a trusted device, they鈥檙e redirected to the 黑料海角91入口 Protect app to register their device with 黑料海角91入口 Go. After entering their credentials (and MFA challenge if enabled by the admin), their device is registered with 黑料海角91入口 Go, establishing their device as trusted.

When users access protected resources, they verify their identity using 黑料海角91入口 Go via the 黑料海角91入口 Protect app with device biometrics, granting access. The hardware-backed 黑料海角91入口 Go token is valid for 1 year.

For a mobile device to be considered trusted:

The device is enrolled in Device Management: Apple MDM and/or Android EMM.
黑料海角91入口 Protect is deployed to the device using Apple VPP and/or Software Management.
The device passes integrity and jailbreak detection checks.

Accessing the 黑料海角91入口 User Portal

If your users access their company resources from the 黑料海角91入口 User Portal, you can create a CAP that restricts access on unmanaged devices. Because users require access to the User Portal to register their devices with 黑料海角91入口 Go, rather than explicitly block access, the highest level of MFA is used for authentication.

Protecting Individual SSO Apps

You can create CAPs for specific SSO apps available to your users. For example, Slack may contain privileged information that you want users to only access from trusted devices. To do so, create a CAP for the Slack SSO app and restrict access on untrusted devices using the Managed Device condition.

Admin Configuration Workflow

After enabling the prerequisite features, configure your mobile devices to start using 黑料海角91入口 Go for Mobile and Device Trust:

Enroll your devices in Device Management. Depending on the device and configuration type, devices can be company enrolled or personally enrolled.
- For company enrolled devices:
  - Apple: See Add Company-Owned Apple Devices to MDM with Device Enrollment to learn more.
  - Android: See Add and Manage Android Devices to learn more.
- For personal devices, user can enroll their device via the User Portal:
  - Apple: See Add Personal Apple Devices to MDM with User Enrollment to learn more.
    - Note: Managed Apple IDs (MAIDs) are required to enroll personal devices in MDM. To perform this action in bulk, see Run the MAID Import Script.
  - Android: See Add and Manage Android Devices to learn more.
Deploy the 黑料海角91入口 Protect app (v2.2.2+茠) to devices using Apple VPP and/or Android Software Management. See Get Started: Software Management.
- Apple: See Manage Software with Apple鈥檚 VPP to learn more.
- Android: See Software Management: Android to learn more.

Important:

Additional configuration is required to use the 黑料海角91入口 Protect Android app. See 黑料海角91入口 Protect Android App.

Create CAPs in 黑料海角91入口 that limit access to the User Portal, SSO apps, or both using the Managed Device condition. Optionally, use the Operating System condition to target specific device types. See Configure a Conditional Access Policy to learn more.

FAQ

Can I use 黑料海角91入口 Go for Mobile without configuring access policies?

Yes, if you don鈥檛 enforce CAPs. You can use 黑料海角91入口 Go to enable secure and seamless authentication on mobile devices.

What is the difference between a managed and trusted device?

Managed device: A device that is enrolled in Device Management (MDM for Apple devices or Google EMM for Android devices). Device management is only one requirement to establish a device as trusted.
Trusted device: A device that meets all of the requirements to be trusted by 黑料海角91入口. This includes enrollment in Device Management as well as 黑料海角91入口 Protect and 黑料海角91入口 Go registration.

Do I need to be enrolled into 黑料海角91入口 Device Management to get Mobile Device Trust? If so, why?

Yes, your mobile device needs to be under management in 黑料海角91入口. NOTE: this is applicable to company-owned and BYO devices.
The current release of Mobile Device Trust uses a number of technologies that are only available via the MDM/EMM protocols.

What if I have contractors that already have management on their devices or are unwilling to enroll in 黑料海角91入口 management?

Currently, devices must be 黑料海角91入口 managed to get access to Mobile Device Trust functionality. See the previous FAQ for more information.

My employees are concerned about the privacy associated with enrolling into 黑料海角91入口. What can I do to assure them that it鈥檚 safe?

End user privacy is a critical pillar for 黑料海角91入口, Apple, and Google. Apple and Google have built enrollment types that specifically cater to employee owned devices to ensure data separation and privacy. 黑料海角91入口 built its BYOD offering on top of Apple鈥檚 and Google鈥檚 MDM/EMM protocols so we are not able to enforce or collect more data than what is enabled by the OEMs.
For details on Apple鈥檚 iOS/iPadOS User Enrollment, see to learn more.
For details on Google鈥檚 Android Work Profile, see to learn more.
Things that 黑料海角91入口 can never see on your enrolled BYO mobile device:
- Calling history
- Web browsing history
- Personal emails
- Personal text messages
- Personal contacts
- Personal calendar
- Personal passwords
- Pictures, including what's in the photos app or camera roll
- Content of user created documents

I have employees that are already accessing company SSO endpoints on their unmanaged personal devices. How do I prevent this or remove their access?

Once you鈥檝e rolled out Mobile Device Trust and enable CAPs to block unmanaged instances, you need to consider forcing a password reset on user accounts. This will terminate long-lived mobile sessions and force user re-authentication. When users re-authenticate, the latest CAPs are evaluated and personal/unmanaged access is blocked.

With iOS User Enrollment, I can鈥檛 have multiple instances of the same application. What happens if I have a company use case involving a mobile app that my employees also use for personal use?

Apple鈥檚 User Enrollment is currently limited to a single app. If you want complete control of the app (for it to be marked as a Managed Application for example), you need to ask users to delete the personally redeemed application and allow for 黑料海角91入口 MDM to push the managed version.

What are the minimum OS requirements?

Android 5.0+
iOS/iPadOS 14+

Does Mobile Device Trust work on iPadOS?

Yes. You will need to install the iOS Protect application and the in-app experience will be a scaled version of the iOS experience but all the functionality required for Mobile Device Trust will exist.

Do I need a Managed Apple ID (MAID)? If so, why?

A Managed Apple ID (MAID) is required to enroll a personal iOS device in 黑料海角91入口 MDM. The option to do User Enrollment in the User Portal will not appear if the user account has an empty Managed Apple ID field in the 黑料海角91入口 Admin Console.
See the following references to learn more:
- Run the MAID Import Script

Is there a Google equivalent of Managed Apple IDs and do I need it?

Currently, all Android EMM enrollments are completed with Managed Google Play accounts that are created at time of enrollment. So at this time, you only need to configure Android EMM.
Google does intend to consolidate the user sign-in experience during device enrollment. End users will in the future use a single managed Google account to log into Android, ChromeOS, and other Google services.

Can I use 黑料海角91入口 Protect for existing MFA factors (Mobile Push, TOTP) in addition to 黑料海角91入口 Go for Mobile (Mobile Device Trust)?

Yes. The registration process for Mobile Device Trust can co-exist with other MFAs in 黑料海角91入口 Protect or other authenticator applications.

Does Mobile Device Trust behave differently based on my enrollment type (Company-owned vs BYOD)?

The general experience after the device is enrolled and has 黑料海角91入口 Protect will be consistent within the OS. Additionally, the user experience between Android and iOS Protect has been aligned for relative parity.