Performing remote operations on managed mobile devices

As an IT administrator, you can perform remote operations on managed mobile devices. The following BMC Client Management video (2:56 min) provides information about performing remote operations for iOS devices using commands:

 https://youtu.be/AHHYgxuwOdU

Using commands, you can remotely perform the following operations on mobile devices:

• Update information about the device, security, restrictions, applications, certificates, and profiles (collect inventory)
• Install or remove configuration profiles (manage profiles)
• Install or remove managed applications (manage applications)
• Lock or wipe (factory reset) mobile device (data security)
• Clear passcode (data security)

Using the Repeat Frequency option in the commands, you can collect inventories at regular intervals, and if a required application is no longer installed (for example, the user might have removed it), you could automatically reinstall it.

You can also use commands to ensure that the enterprise data stored on the mobile device is accessed only by the authorized user. If the mobile device is stolen or misplaced, you use the Wipe or Lock command to ensure that your data is not accessible to unauthorized users. If the user forgets the passcode, you can remotely clear the passcode allowing seamless data access to your users.

The following screenshot shows the list of commands, the objects assigned to the command, and its General tab:

(Android only) The Change Profile command supports the parameter:

• Profile (mandatory): The profile to set on the devices. In case case, the rules enforced by the previous management profile are removed and those configured in the new profile are applied. For each device, the operation will fail if the new and replaced profiles do not belong to the same enterprise.

(Android only) The Clear Application Data command makes it possible to clear the cached data for the supplied application identifier. The following parameter is supported:

• Application Package Name (mandatory): The identifier of the application for which data must be cleared, for example: org.mozilla.firefox

To create and assign a mobile command

1. In the left pane, select Mobile Device Management.

2. Right-click Commands, and select Create Mobile Command .
   The Command Wizard window is displayed.

   Tip

   You can create multiple folders under Commands to organize your mobile commands.

3. In the Command page, specify the details as required, and click Next.
   The Command Options page is displayed. Depending on the command type on the preceding page, different command options are displayed. For a detailed list of available command options, see Examples of remote operations. 

   Note

   Depending on the command type, parameters (optional or mandatory) may be available. Some commands also offer parameters for Apple or Android devices only. If the command does not have any parameters, the Command Assignment page is displayed.

4. Set the command options, and click Next.
   The Command Assignment page is displayed.

5. Assign the command to the target devices, device groups, users, or user groups, and click Finish.
   The command is created and assigned to the target mobile devices.

To view the status of a mobile command

After you assign the command to the target mobile devices, you can view the command status by navigating to the following locations in the left pane:

• Mobile Device Management > Commands > mobileCommandName > Assigned Objects > Devices

• Mobile Device Management > Mobile Devices > Managed Mobile Devices > mobileDeviceName > Assigned Objects > Commands

In the right pane, all of the commands that were assigned to the mobile device are displayed with their status.

• If the command is assigned to the mobile device for the first time, the sequence of the command status is as follows:
  Assignment Waiting > Assignment Notified > Assignment Sent > Executed/Execution Failed/Not Notified.
• If the command is already assigned to the mobile device and the user initiates command reassignment, the sequence of the command status is as follows:
  Reassignment waiting > Update notified > Update sent > Executed/Execution Failed/Not Notified.

The following table describes different command status:

To use a direct access command to clear a pass code or to wipe or lock a mobile device

The following are security-related commands that are accessible as direct access options for managed mobile devices:

• Clear Passcode (Android only) supports the following optional parameters:
  
  • New Password: Set a new password on the device. This must respect the passcode policy if a passcode policy is applied. If the new password does not respect this, the command fails.
  • Require Entry: Do not permit other administrators to change the password again until the user has entered it.
  • Do not ask credentials: Do not ask for user credentials on device boot.
  • Lock Now: Lock the device after password reset.
• Wipe Mobile Device:
  • • For Apple and Corporate-Owned Android devices, the Wipe Mobile Device command resets the device to factory settings. The user is not informed about the mobile device being reset to factory settings. 
  • For Personally-Owned Android devices, the Wipe Mobile Device command simply removes the professional workspace and all the linked information. The user is informed of this operation.

• Lock Mobile Device

1. Right-click the mobile device to which you want to assign the command, and select Direct Access Tools.
2. Select the command you want to use.
3. Click OK to confirm.
   The command is sent to the target mobile device.

To collect inventories

Depending on the type of the inventory you want to collect, you can use the following command types:

• Update Device Information
• Update Security Information
• Update Device Restrictions (for Apple devices only)
• Update Installed Applications
• Update Configuration Profiles (for Apple devices only)
• Update Certificates (for Apple devices only)

When a mobile device is audited (using the Audit Now option), the following three mobile commands are assigned to the mobile device:

• Update Device Information
• Update Device Security
• Update Installed Applications 

You can also set a command to regularly collect inventory using the Repeat Frequency option. This is helpful if regular inventory audits are part of your organization's compliance policy or a statutory requirement.

To install mobile applications on Apple devices

Using commands, you can install mobile applications on the target mobile devices. For more information about installing application added to the Mobile Applications list, see To install an application from the Mobile Applications list to a target mobile device.

To install applications that are not listed in the Mobile Applications list, you need to have either of the following identifiers:

• Application bundle identifier
• Application iTunes identifier 

For more information about finding these numbers, see To search and add an application to the Mobile Applications list.

For example, you may get a request from users to have a public email service client (such as Gmail) installed on their managed mobile device. You may not have this application in your mobile application list, as this is not either an approved application or a restricted application as per your organization's policy.

1. Create a command using the command type Install Application. For more information, see To create and assign a mobile command.
2. On the Command Options page, in the Application to install list, select either the Application bundle identifier or Application iTunes identifier option, and specify the corresponding value.

3. Assign the command to the target mobile devices.

   When the command is executed on the mobile device:

   • If the mobile device is supervised, the application is installed on the target mobile device.
   • If the mobile device is not supervised, the user receives a notification to install the application. The user can either install the application or ignore the notification.

   Tip

   If your mobile device is supervised, a message is displayed below the screen lock. For example, This iPad is managed by your organization.

   
   

To install mobile applications on Android devices

The Applications tab of the Android Profile configuration panel shows the applications that may or may not be installed on the device. Depending on the enrollment type the applications may concern the entire device, or the work environment only. For Apple devices, you can install applications using commands, this is not possible with Android devices. Rather, this operation must be done using management profiles; that is, the Applications payload of Android management profiles.

To install an application

1. Currently, the API does not provide a simple search mechanism to search for the applications. Rather, you need to find the Application Identifier manually:
   1. Go to Google PlayStore. 
   2. Search for the application you are interested in. 
   3. Select and copy  the Application Identifier from the URL. For example: com.spotify.music.
2. In the BMC Client Management java console, go to Mobile Device Management > Profiles > New Mobile Profile> Configuration > Applications.
3. Enter your Application identifier to the Package name section. 
4. Select one of the Installation types:
   • Application is automatically installed and can be removed by the user 
   • Application is automatically installed and can't be removed by the user
   • Application is blocked and can't be installed. Well be uninstalled if installed under a previous policy
   • Application is available to install
     • Application is automatically installed in kiosk mode 
5. Save the profile.
   The profile is updated for Google Cloud. You can see your applications available in your work PlayStore, or even already installed to the device if you selected relevant installation type. 

To remove an application by using a command from Apple devices

You can also remove applications using commands. For example, when an employee, who had enrolled a personal mobile device, leaves the organization. You had installed business-specific applications (such as BMC MyIT) on the employee's mobile device. As the employee is leaving the organization, you want to remove those applications from the employee's mobile device.

1. Create a command using the command type Remove Application. For more information, see To create and assign a mobile command.
2. On the the Command Options page, in the Application to remove list, select one of the following options:
   
   • If the application to remove is listed under Mobile Applications, select the Application from list option, and then browse and select the application that you want to remove.
   • If the application to remove is not listed in under Mobile Applications, select the Select bundle identifier option, and specify the value. For more information about finding the bundle identifier, see To search and add an application to the Mobile Applications list.
3. Assign the command to the target mobile devices.
   The application is removed when the command is run on the target mobile device.

To remove an application from Android devices

As application management in Android is performed using management profiles, it is possible to remove an application by simply updating Android management profiles.

For example, Spotify can be automatically installed, or made available in the corporate PlayStore, by adding it to the Application payload in the management profile. By removing the same entry, the Spotify application can be automatically uninstalled, or removed from the corporate PlayStore.

Depending on the enrollment type (Corporate or Personally-Owned), the application management may vary. 

Examples of remote operations

The following table lists the examples of remote operations that you can perform, the type of mobile commands that you can use, and available command options: