Editing default iOS MDM settings

3 min

iOS MDM settings are editable, though, in most cases, you should not change access rights here.

Besides the initial iOS / macOS device registrations, the MDM profile is pushed to the device during

Ivanti Mobile@Work re-enroll option

Changing of the MDM access rights. Choosing less access rights results in the MDM profile being updated automatically; more access rights require a user prompt which is done via Ivanti Mobile@Work . If the device does not have Ivanti Mobile@Work , the MDM profile does not get updated until the device is retired and re-registered.

A re-push of the MDM profile will result in any applications with the Send convert unmanaged to managed app request on device registration or sign-in (iOS 9 or later) option selected. A repush of the MDM profile is considered a re-registration for the app install process. For more information, see the Ivanti EPMM Apps@Work Guide.

Edit the default iOS MDM settings.

Procedure

Go to Policies & Configs > Configurations.

Select the System - iOS MDM configuration.

Select Edit to open the Modify Profile MDM Setting dialog box.

If changing an access right is necessary, select an access right in the Available list and select the appropriate arrow to move the access right to the Selected list. The table below summarizes these access rights.

If you want Ivanti EPMM to indicate that the MDM profile has been removed from iOS devices, select Check out when MDM profile is removed.

Receipt of this alert is not guaranteed. Therefore, this setting does not ensure notification upon removal of the profile.

If you want to automatically alert iOS users when a new iOS MDM configuration is available, select Send an APNs message to iOS 5 and later devices to inform them that a new iOS MDM configuration is available.

Select the Enable Certificate Pinning for Server/Check in URL option, if you want the devices to trust specific certificates during device enrollment. This option is not selected by default.

Select the Pinning Certificate Revocation option, if you want the devices to validate the certificates and perform certificate pinning validation against the Certificate Revocation List.

Select + to add a list of existing certificates from the drop-down list in the Check-In URL Certificate Mapping pane.

Select + to add a list of existing certificates from the drop-down list in the Server URL Certificate Mapping pane. Follow the procedure in the Uploading a trusted root certificate to Ivanti EPMM to upload a new certificate. For more information, see Enabling S/MIME encryption and signing on iOS devices.

Make sure that the existing certificates have Leaf Certificate and Intermediate CA Certificates.

Select Save.

Table: Access Rights

Access Right	Notes
Allow inspection of profiles manifest	Enables inventory of configuration profiles.
Allow installation and removal of profiles	Enables overall configuration tasks.
Allow device lock and passcode removal	Enables remote lock and unlock capabilities.
Allow device erase	Enables remote wipe.
Allow query of Device Information	Enables inventory of standard device items, such as device capacity, serial number.
Allow query of Network Information	Enables inventory of standard network items, such as phone or SIM numbers, MAC addresses.
Allow inspection of installed provisioning profiles	Enables a device user to run select in-house apps.
Allow installation and removal of provisioning profiles	Enables installation of select in-house apps.
Allow inspection of installed applications	Enables app inventory.
Allow restriction-related queries	Enables reports on the restrictions of each configuration profile on the device. These correspond to the settings in the iOS Restrictions and Passcode payloads.
Allow security-related queries	Enables report on security items, such as whether a passcode is present.
Allow manipulation of settings	Enables an administrator to turn on or off voice and data roaming.
App management: Availability: iOS 5.0 and later	Enables the managed apps capability so that an administrator can push requests to install apps, prevent iCloud backup, and remove the apps and all app data on demand.
Apply settings. Availability: iOS 5.0 and later	Enables the settings that an administrator can push requests to apply various settings on the devices.