Performing remote operations on managed mobile devices

The IT administrators can perform the remote operations on the managed iOS mobile devices.

The following BMC Client Management video (2:56 min) provides information about performing remote operations using commands:

 https://youtu.be/AHHYgxuwOdU

Using commands, you can remotely perform the following operations on mobile devices:

• Update information about the device, security, restrictions, applications, certificates, and profiles (collect inventory)
• Install or remove configuration profiles (manage profiles)
• Install or remove managed applications (manage applications)
• Lock or wipe (factory reset) mobile device (data security)
• Clear passcode (data security)

Using the Repeat Frequency option in the commands, you can:

• Collect inventories at regular intervals. For example, you might want to run a command to collect security inventory every seven days, installed applications inventory every 15 days, and device information inventory every 30 days.
• Ensure that users have important applications installed all the time. For example, you can create a command to install Outlook and set the Repeat Frequency option to one day. So, even if the user removes Outlook application from the mobile device, the command installs it again the next day.

You can also use commands to ensure that the enterprise data stored on the mobile device is accessed only by the authorized user. If the mobile device is stolen or misplaced, you use the Wipe or Lock command to ensure that your data is not accessible to unauthorized users. If the user forgets the passcode, you can remotely clear the passcode allowing seamless data access to your users.

The following screenshot shows the list of commands, the objects assigned to the command, and its General tab:

The following topics are provided:

• To create and assign a mobile command
• To view the status of a mobile command
• To use a direct access command to clear a pass code or to wipe or lock a mobile device
• To collect inventories
• To install an application that is not in your Mobile Applications list
• To remove an application by using a command
• Examples of remote operations

To create and assign a mobile command

1. In the left pane, select Mobile Device Management.

2. Right-click Commands, and select Create Mobile Command .
   The Command Wizard window is displayed.

   Tip

   You can create multiple folders under Commands to organize your mobile commands.

3. In the Command page, specify the details as required, and click Next.
   The Command Options page is displayed. Depending on the command type on the preceding page, different command options are displayed. For a detailed list of available command options, see Examples of remote operations. 

   Note

   If the selected command type is an update command (Update xxxx), Clear Passcode, or Wipe Mobile Device, the Command Options page is not available and the Command Assignment page is displayed.

4. Set the command options, and click Next.
   The Command Assignment page is displayed.
5. Assign the command to the target devices, device groups, users, or user groups, and click Finish.
   The command is created and assigned to the target mobile devices.

To view the status of a mobile command

After you assign the command to the target mobile devices, you can view the command status by navigating to the following locations in the left pane:

• Mobile Device Management > Commands > mobileCommandName > Assigned Objects > Devices
• Mobile Device Management > Mobile Devices > Managed Mobile Devices > mobileDeviceName > Assigned Objects > Commands

In the right pane, all of the commands that were assigned to the mobile device are displayed with their status.

• If the command is assigned to the mobile device for the first time, the sequence of the command status is as follows:
  Assignment Waiting > Assignment Notified > Assignment Sent > Executed/Execution Failed/Not Notified.
• If the command is already assigned to the mobile device and the user initiates command reassignment, the sequence of the command status is as follows:
  Reassignment waiting > Update notified > Update sent > Executed/Execution Failed/Not Notified.

The following table describes different command status:

To use a direct access command to clear a pass code or to wipe or lock a mobile device

The following are security-related commands that are accessible as direct access options for managed mobile devices:

• Clear Passcode
• Wipe Mobile Device
• Lock Mobile Device

1. Right-click the mobile device to which you want to assign the command, and select Direct Access Tools.
2. Select the command you want to use.
3. Click OK to confirm.
   The command is sent to the target mobile device.

To collect inventories

Depending on the type of the inventory you want to collect, you can use the following command types:

• Update Device Information
• Update Security Information
• Update Device Restrictions
• Update Installed Applications
• Update Configuration Profiles
• Update Certificates

When a mobile device is audited (using the Audit Now option), the following three mobile commands are assigned to the mobile device:

• Update Device Information
• Update Device Security
• Update Installed Applications

You can also set a command to regularly collect inventory using the Repeat Frequency option. This is helpful if regular inventory audits are part of your organization's compliance policy or a statutory requirement.

To install an application that is not in your Mobile Applications list

Using commands, you can install mobile applications on the target mobile devices. For more information about installing application added to the Mobile Applications list, see To install an application from the Mobile Applications list to a target mobile device.

To install applications that are not listed in the Mobile Applications list, you need to have either of the following identifiers:

• Application bundle identifier
• Application iTunes identifier

For more information about finding these numbers, see To search and add an application to the Mobile Applications list.

For example, you may get a request from users to have a public email service client (such as Gmail) installed on their managed mobile device. You may not have this application in your mobile application list, as this is not either an approved application or a restricted application as per your organization's policy.

1. Create a command using the command type Install Application. For more information, see To create and assign a mobile command.
2. On the Command Options page, in the Application to install list, select either the Application bundle identifier or Application iTunes identifier option, and specify the corresponding value.

3. Assign the command to the target mobile devices.

   When the command is executed on the mobile device:

   • If the mobile device is supervised, the application is installed on the target mobile device.
   • If the mobile device is not supervised, the user receives a notification to install the application. The user can either install the application or ignore the notification.

   Tip

   If your mobile device is supervised, a message is displayed below the screen lock. For example, This iPad is managed by your organization.

   
   

To remove an application by using a command

You can also remove applications using commands. For example, when an employee, who had enrolled a personal mobile device, leaves the organization. You had installed business-specific applications (such as BMC MyIT) on the employee's mobile device. As the employee is leaving the organization, you want to remove those applications from the employee's mobile device.

1. Create a command using the command type Remove Application. For more information, see To create and assign a mobile command.
2. On the the Command Options page, in the Application to remove list, select one of the following options:
   
   • If the application to remove is listed under Mobile Applications, select the Application from list option, and then browse and select the application that you want to remove.
   • If the application to remove is not listed in under Mobile Applications, select the Select bundle identifier option, and specify the value. For more information about finding the bundle identifier, see To search and add an application to the Mobile Applications list.
3. Assign the command to the target mobile devices.
   The application is removed when the command is run on the target mobile device.

Examples of remote operations

The following table lists the examples of remote operations that you can perform, the type of mobile commands that you can use, and available command options: