Additional Configurations Using KVP
Key Value Pairs (KVP) are simple application settings that consist of a key (the name of the setting) and a value (the configuration to apply).
Using Ivanti Mobile@Work, organizations use KVPs to enable or disable features and adjust app behavior without requiring an app update.
When Ivanti Mobile@Work is operating on organization managed devices, it reads these KVP settings at start-up or during a check‑in. The app applies the updates immediately, ensuring that configuration changes are delivered quickly, consistently, and to the correct users.
Configuring Ivanti Mobile@Work App
The Ivanti Mobile@Work app supports KVPs to customize violation messages.
You can manually configure the Ivanti Mobile@Work app settings using Ivanti EPMM to customize application behavior as follows:
Procedure
- Log in to Ivanti EPMM admin portal.
- Go to Apps> Apps Catalog.
- Enter Ivanti Mobile@Work in the Search by Name field. Optionally, you can enter a label in the Type label to filter field, select one of the options from Source, or select one of the Platform options in the Filters pane to search an app.
- Select the Ivanti Mobile@Work app. The App Configurations pane appears.
- Click Edit.
- Navigate to Managed App Configurations section to customize and prioritize app configurations based on app usage.
- Click Add+ to add app configuration. The New App Configuration pane appears.
- Enter the name of the configuration in the App Configuration Name field.
- Select a source in the Source Type field.
- Upload a .xml file type.
Make sure that the file type is .xml and it must contain the Version and Bundle ID that denotes the KVP for the app.
- Click Add.
- Select Save to successfully customize the app configuration. The updated KVPs apply to devices during the next check‑in.
Adding Multiple KVPs
Administrators can configure multiple KVPs for a managed iOS app by using app serial numbers, bundle identifiers, version details, or other metadata.
This feature requires a separate license. Prior to using this feature, ensure your organization has purchased the required licenses.
They must upload a .plist file type in the Ivanti EPMM admin console to complete this configuration efficiently as follows:
Procedure
- Log in to Ivanti EPMM admin portal.
- Go to Policies & Configs> Configurations.
- Select Add New > Apple > iOS / macOS / tvOS > Managed App Config. The New Managed App Config Setting pane appears.
- Enter the name of the configuration in the Name field.
- Enter the description of the configuration in the Description field.
- Enter the bundle ID of the app in the BundleID field.
- Browse and upload a .plist file type in the File field.
The uploaded file must have a .plist extension. If you have manually created the file (for example, in a text editor), make sure that the extension is changed from .txt to .plist before uploading.
- Select Save.
- Select Apply Labels to distribute the configuration to applicable groups or devices. For more information, see "Applying configurations to labels".
Single App Mode Activation During Device Registration
This feature allows administrators to use KVPs during device registration to automatically launch Ivanti Mobile@Work in Single App Mode (SAM). When the device starts enrollment, the configured KVPs trigger Ivanti Mobile@Work to open immediately. During this process, the user sees the following message: Please wait while your device is being configured.
To enable this behavior, you must install the SAM configuration and explicitly target it to Ivanti Mobile@Work before or during the registration workflow.
After the device completes enrollment, it automatically exits SAM. The device is then released to the user for normal operation, ensuring a secure setup without limiting use after registration.
This capability provides a controlled and secure registration flow for supervised devices.
Setting Up Zero-Touch Activation
To enable Zero-Touch activation for Ivanti Mobile@Work, perform the following steps:
Procedure
- Set up a Label that includes only devices where Client Registered = No.
- Create a Single App Mode (SAM) configuration for the Ivanti Mobile@Work application and assign it to the Label you have created.
- Add the zero_touch_activation KVP to the Ivanti Mobile@Work application configuration and target the same Label.
The following table displays the KVP configuration for Zero-Touch activation:
Key | Value | Type | Description |
|---|---|---|---|
zero_touch_activation | True | Boolean | When the value is set to true, the Ivanti Mobile@Work app recognizes that it is running in Single App Mode (SAM) through the SAM configuration. The SAM configuration launches the Ivanti Mobile@Work app, while this value acts as an additional setting that enables the app to function correctly in SAM mode. After successful enrollment, the device exits Single App Mode and becomes available to the end user for normal use. |
Disable Screenshot Protection on SAML Authentication Screen
The Ivanti Mobile@Work app includes built‑in screenshot protection to enhance security during device registration.
By default, the registration screens that use SAML authentication blocks the following:
- Screenshots
- Screen recordings
- Screen sharing
This protection ensures that sensitive authentication data such as usernames, passwords, and SAML based login content cannot be captured or shared without authorization.
Administrators can disable screenshot protection on managed devices by using a KVP configuration.
When this configuration is applied, the Ivanti Mobile@Work app allows screenshots and screen recordings only on the SAML authentication screen while maintaining all other security protections across the app.
To disable screenshot protection for SAML authentication screen, apply the following KVP to Ivanti Mobile@Work app configuration in Ivanti EPMM:
Key | Value | Description |
|---|---|---|
SCREENSHOT_PROTECTION_DISABLED | True | Disables screenshot, screen recording, and screen sharing protection on SAML authentication screen. When you omit this setting or set it to False, the protection remains enabled by default. |
Configure Default Browser and Email KVPs Using Managed App Configuration
KVPs enable administrators to configure which browser and email app the Ivanti Mobile@Work uses when opening web links and composing emails via Managed App Configuration.
As an administrator, you can use Managed App Configuration KVPs to control how links are handled within the Support tab:
Key | Values | Type | Description |
|---|---|---|---|
default_browser | Safari Edge Chrome Firefox Brave Opera Web@work DuckDuckGo | String | The Ivanti Mobile@Work uses a browser to open web links in the Support tab. http or https links are redirected to the configured browser scheme. If a default browser is not configured, it uses the device's default browser. |
Allow_browser_fallback | True False | Boolean | Behavior when default browser is not installed:
|
restrict_log_sharing_to_email | True False | Boolean | Whether log or support sharing is restricted to email only (using default_email). Auto-attaching logs works with Email+ and Native mail works with allow_email_fallback.
|
default_email | Native Mail Outlook Gmail Yahoo Citrix Mail Email+ Spark Protonmail | String | Ivanti Mobile@Work uses one of the email apps to compose mails from mailto links in Support tab. mailto is transformed into the user's composing URL. Default if not configured: Default mail application. Dual role in link resolution and log sharing when default_email app is not installed. |
Allow_email_fallback | True False | Boolean | Behavior when default email is not installed:
|
KVPs to Customize Policy Violation Messages
The Key Value Pairs (KVP) enable administrators to customize the messages sent to end users when policy violations occur.
The KVPs for customization describe the available KVPs and violation types that administrators can use to modify Ivanti Mobile@Work app behavior.
The violation types are not mutually exclusive. When multiple violations occur, the Ivanti Mobile@Work app displays a list of all applicable messages.
The KVPs in the following table define how the app behaves, including providing detailed notifications to device users and exporting contacts from Ivanti Mobile@Work:
Table: KVPs with Default Messages
Key Value Pairs (KVP) | Default Messages |
|---|---|
| • Your device has been compromised because it has been jailbroken. Please properly return your device to a non-jailbroken state or contact your administrator for help resolving this issue. |
| • Your device is running an unsupported, older version of iOS. Please upgrade to the latest version of iOS or contact your administrator for help resolving this issue. |
| • Your iOS device is not supported. Please contact your administrator for help resolving this issue. |
| • Corporate access has been disabled for data protection. Please contact your administrator for help resolving this issue. |
| • Corporate access has been disabled as the policy is out of date. Please contact your administrator for help resolving this issue. |
| • Your iOS device is out of contact. Please contact your administrator for help resolving this issue. |
| • Your device is missing apps that are required and/or it has apps that aren’t allowed. Please add/remove necessary apps or contact your administrator for help resolving this issue. |
| • You have too many mobile devices configured to access corporate email. Please contact your administrator for help resolving this issue. |
| • Your device is auto blocked. Please contact your administrator for help resolving this issue. |
| • Your administrator has manually disconnected your device from corporate access. Please contact your administrator for help resolving this issue. |
| • Corporate access has been disabled for issues with exchange. Please contact your administrator for help resolving this issue. |
| • Your device is out of compliance because MDM capability has been deactivated. Please re-enroll your device, or contact your administrator for help resolving this issue. |
| |
| • Please contact your administrator about any loss of corporate access issues. |
| • Corporate access has been disabled for an unspecified reason. Please contact your administrator for help resolving this issue. |
| Your device is out of compliance for the following reason(s): |
compliance.message.COMPROMISEDcompliance.message.OS_VERSIONcompliance.message.HW_VERSIONcompliance.message.DATA_PROTECTIONcompliance.message.POLICY_OUT_OF_DATEcompliance.message.DEVICE_OUT_OF_CONTACTcompliance.message.APP_CONTROLcompliance.message.PER_MAILBOX_LIMITcompliance.message.AUTO_BLOCKcompliance.message.MANUALcompliance.message.EXCHANGEcompliance.message.DEVICE_ADMIN_DEACTIVATEcompliance.message.INTERNATIONAL_ROAMINGcompliance.message.REASON_UNKNOWNcompliance.message.genericcompliance.message.headerIf blocked reasons list does not contain any value that has a mapped message but contains at least one violation that does not have mapped message then there will be a default message: “• Corporate access has been disabled for an unspecified reason. Please contact your administrator for help resolving this issue."
If there is at least one violation message in the messages list then there will be a header for the messages list: “Your device is out of compliance for the following reason(s):”
If you do not want to change a default message, do not provide a KVP for it; only include KVPs for the messages you intend to modify.