MOBILE APPLICATION management WITH · PDF fileMOBILE APPLICATION MANAGEMENT WITH MICROSOFT...
Transcript of MOBILE APPLICATION management WITH · PDF fileMOBILE APPLICATION MANAGEMENT WITH MICROSOFT...
17th February 2015
MOBILE APPLICATION
MANAGEMENT WITH
MICROSOFT INTUNE
Gerry Hampson | Blog: www.gerryhampsoncm.blogspot.ie | Twitter: @gerryhampson
1. Introduction
December 2014 was a big month for Microsoft Intune. Additional features were added such as
conditional access, bulk enrolment of iOS devices and lockdown of Windows Phone 8.1 devices
(Kiosk mode). However, for me, the most eagerly awaited features were the introduction of new
mobile application management (MAM) capabilities.
The additional features were described in the Intune Team Blog:
http://blogs.technet.com/b/microsoftintune/archive/2014/12/09/new-mobile-application-management-
capabilities-coming-to-microsoft-intune-this-week.aspx
Managed Browser for Android
PDF Viewer, AV Player, and Image Viewer apps for Android devices
Office mobile apps (Word, Excel, PowerPoint) for iOS devices
Intune App Wrapping Tool for iOS
In Feb 2015 the solution was further improved when new apps were released to further enhance the
MAM experience on Android and iOS devices.
Microsoft Word for Android
Microsoft Excel for Android
Microsoft PowerPoint for Android
Microsoft OneNote for Android
Microsoft Outlook for Android
Microsoft Outlook for iPad
The sections below describe how this technology works (and it works very well). We will see how to
secure the managed browser to only be able to open a single URL (SharePoint site). It will only be
possible to open content using a managed app. We will see how this looks on an Android device.
Create Policies
Add and deploy Intune Managed Browser
Add and deploy PDF Viewer
Install Managed Apps and test MAM functionality
Available Managed Apps
2. Create Policies
Open the Intune console so that we can create the policies to introduce the concept of
containerisation. We will configure a MAM container so that data can only be shared between
managed apps.
We are only interested in Android devices for the moment but we will see that we can also create
policies for iOS devices.
Open Policy > Configuration Policies.
Click to Add a new configuration policy. Browse to the Software Section.
See our choices:
Managed Browser Policy for iOS or Android
Mobile Application Management Policy for iOS or Android.
We'll choose Mobile Application Management Policy for Android this time. Click to "Create a custom
policy". Now see the available options. Note that I have chosen all default settings.
Give the policy a name. It makes sense to choose Yes for "Restrict web content to display in the
Managed Browser" (when this setting is enabled, any links in the app will be opened in the Managed
Browser).
See options for preventing data leakage.
Require a PIN for access to the containerised area.
I like to disable screenshots of the managed area (makes sense if you are securing data).
The Android Mobile Application Management Policy has been created. See that this policy cannot be
deployed directly. It must be associated with the software that it will manage.
OK, now let's create the Managed Browser Policy.
Name the policy and configure the URLs that you want to secure. I only have one.
Policy has been created. See again that this policy must be associated with the software which it will
manage.
3. Deploy Managed Browser
The Intune Managed Browser for Android was added to the Google Store in December 2014.
https://play.google.com/store/apps/details?id=com.microsoft.intune.mam.managedbrowser
Open the Intune console and browse to Software > Managed Software.
Click to "Add" software.
Enter your Intune credentials to open the Microsoft Intune Software Publisher.
Select "Add Software".
Choose "External Link" and enter the URL for the Managed Browser in the Google Store.
Enter the app details and add an icon if you wish.
Click "Upload" to finish.
The Managed Browser is now available in Intune. Now we must deploy the browser.
Select the software and choose "Manage Deployment".
Select the Group to which you want to deploy (pre-created group of users or devices).
Note that "Available" is the only option (Required is greyed out).
Associate with the previously created MAM Policy.
Associate with the Managed Browser Policy.
4. Deploy PDF Viewer
We've added and deployed the Managed Browser. Now we need a managed app that will open the
managed content. Enter the Intune PDF Viewer. This was added to the Google Store in December
2015.
The process to add and deploy the PDF viewer is the same as before.
Add the software.
Upload.
Manage the deployment.
Select the target group.
Must be "Available".
Select the MAM Policy.
5. Test MAM Functionality
OK, we've finished the Intune configuration for now. So what does Mobile Application Management look like on the device (Android)? Let's see. Remember that we deployed the Intune Managed Browser as "Available". Now we must install it. Open the Intune Company Portal on the device.
Browse to Apps to see the Managed Browser and the PDF Viewer. Let's just install the browser for now. Click on the software.
Select "View in Google Play".
This takes us to the location of the software in the Google Store. Click to Install.
“Accept”
Now open the App.
We are prompted to set a PIN for the managed container.
The Managed Browser is installed. Now the fun starts. Launch the browser.
I use a mirroring software to display my Android device on the monitor. Note that the device screen goes dark when the Managed Browser opens. How cool is that? There is no chance to take a screenshot of any data. I've taken photographs of the rest of the process.
This is the Intune Managed Browser for Android. It is based on Chrome and has much of the same functionality you would expect from a browser - see where you can bookmark URLs. Try to access a URL that you have not configured.
Access is blocked.
We can only access the allowed URLs.
This is a list of documents from the allowed SharePoint site. Remember that we have not yet installed any other Managed Apps. Therefore we should not be allowed to open any content.
......and we can't.
Now let’s install the PDF Viewer.
Now I have better success opening my managed PDFs.
6. Available Managed Apps
At the present time the following managed apps are available.
Android Apps
Managed Browser
PDF Viewer
AV Player
Image Viewer
Microsoft Word
Microsoft Excel
Microsoft PowerPoint
Microsoft OneNote
Microsoft Outlook
iOS Apps
Managed Browser (pending Apple Store approval)
Microsoft Word for iPad
Microsoft Excel for iPad
Microsoft PowerPoint for iPad
Microsoft OneNote for iPad
Microsoft Outlook for iPad
Also Microsoft have released an iOS Wrapping tool with which you can enable your own apps to be
managed without any software development.