Registration methods

23 min

Registering a device designates it for management by Ivanti EPMM.

Support for Android 5.0 and 5.1 has ended. Ivanti EPMM server will still allow existing registered devices with Android 5.0 / 5.1 to run.

Prerequisites

Setting the registration PIN code length for device user registration

The following registration methods are available:

In-app registration

Users register additional devices

Administrator registers ActiveSync devices

Registering an Apple TV

Registration via user portal

The process resulting from these methods may vary by device OS.

Administrator invites device users to register

For device users who are mobility savvy and do not require significant assistance, you can send an invitation and enable them to register their own phones. You can send an invitation to multiple users from the Users Management screen. The invitation includes instructions on how to log into the user portal to register phones.

The administrator needs to know the following information for the device:

Phone number (if any)

Country

Platform

In-app registration

One way to reduce the load on IT personnel is to instruct iOS, macOS, and Android users to download the Ivanti EPMM app directly from the App Store on iTunes or from Google Play and initiate registration from within the Ivanti Mobile@Work app.

If the administrator has not enabled Server Name Lookup, the email the device user gets will ask them to enter the full URL of Ivanti EPMM into Ivanti Mobile@Work. If the administrator enabled Server Name Lookup, the email sent to the device user will ask them to enter the email domain.

For iOS devices

Go to Settings > System Settings > iOS > MDM and select the Send email to device user and notification to client if MDM profile is not installed check box.

You will need to enable the MDM profile. In the MDM page, select the Enable MDM Profile check box.

You can enter the Apple ID used to generate or renew the MDM certificate.

Select Save.

Go to Settings > System Settings > Users & Devices > Device Registration. In the In-App Registration Requirement field, select one of the following:

Password - device user will be required to enter username and password.

Registration PIN - device user will be required to enter a registration PIN.

Password and Registration PIN - device user will be required to enter a username, password, and registration PIN.

User and Registration PIN - prompts device user to enter username and PIN.

Allow silent in-app registration only - Selecting the check box will install the app silently. The app is installed when the device checks in with Ivanti EPMM.

Silent in-app registration time limit (minutes) iOS and macOS) - Keep the default 240 minutes or enter your preferred time limit.

Select Save.

For Apple Web-based Registration Requirement, select one of the following:

Password - device user will be required to enter username and password.

Registration PIN - device user will be required to enter a registration PIN.

Password and Registration PIN - device user will be required to enter a username, password, and registration PIN.

User and Registration PIN - prompts device user to enter username and PIN.

Select Save.

Device users of iOS 12.2 and later will need to download Ivanti Mobile@Work, manually navigate to Settings view and download the MDM profile.

Device users then complete the registration process by responding to registration prompts. If Ivanti EPMM detects that the MDM profile has not yet been installed, upon the next device check-in, Ivanti Mobile@Work will display a notification asking the device user to re-enroll.

In iOS 13, the option to "Allow Always" was removed from the iOS Settings app. Instead, a dialog box displays requesting device users to enable tracking when the Ivanti Mobile@Work app is running. Ivanti Mobile@Work opens iOS Settings where device users can choose "Ask Next Time" or "Never". Ivanti, Inc recommends device users to enable tracking. This change applies to all versions of iOS 13 or supported newer versions. Ivanti Mobile@Work for iOS does not track device users' location without consent.

For macOS devices

Applicable to macOS 11.0 or supported newer versions.

Once completed, the mac device is a supervised device.

Procedure

For macOS device registration in the self-service portal, a device user must perform the following steps:

In the Install Management Profile page, the device user grants permission for the download of the profile. The profile is downloaded to the device user's local system.

Double-click the downloaded profile (macenroll.mobileconfig) to make it visible in the device user's System Preferences. There is limited time for the device user to install the profile before it becomes invalid.

Go to System Preferences > Profiles.

Select Install to install the management profile.

Continue and finish the installation procedure. Enter the system password when prompted.

Administrator tasks

This feature depends on access to the Ivanti EPMM Gateway; therefore, the corresponding port must be properly configured. See the Pre-Deployment Checklist in the On-Premise Installation Guide for details. The User Portal role must be assigned to the user.

To auto-populate the Ivanti EPMM server name during registration, the following setup is required:

The user associated with the device must be known as an LDAP user or defined as a local user.

To auto-populate based on the email address, you must register your VSP with Ivanti EPMM

Set up the registration email template, see Customizing registration messages

Schedule email reminders, see Customizing registration messages

Send the email invitation to device users.

Customized registration using SAML IdP

As a part of the registration process, device users log into a third-party identity provider (IdP), such as Ping. Once the authentication is successful, the device user is prompted to download the profile, completing the registration process.

Prerequisites

You must have SAML enabled. See "Configuring SAML/IdP support" in the Ivanti EPMM System Manager Guide

Procedure

Enable SAML in the System Manager.

Configure an identity provider.

In the Admin Portal, go to Settings > Users & Devices > Device Registration page.

In the Device Registration page, select SAML Authentication. If this field is not selected, there will be no change in the registration.

Once the SAML on iReg, DEP, or Android is set, SAML configuration from the System Manager can be neither disabled or deleted. You must first de-select the SAML registration in the Device Registration page in Ivanti EPMM before you can disable the IdP SAML connection in the System Manager.

Select Save.

Enabling SAML for Android

Procedure

Go to Settings > System Settings > Users & Devices > Device Registration.

Select the SAML Authentication for Android Enrollment checkbox. A Warning pop-up window pane displays the message, Enabling SAML Authentication for Android will override all other authentication methods. All Android registrations will mandatorily go through SAML authentication.

Click OK.

Select Save.

Customized registration using a URL or a QR Code

As a convenience, instead of device users entering registration credentials, you can setup an infrastructure to use a QR Code or URL link to automatically enter the registration credentials. This feature is applicable for iOS and macOS devices.

Prerequisites

The company administrator must set up an infrastructure to generate a web page containing a QR Code or URL link from the credentials generated by UEM (see Implementing infrastructure for QR code with device PIN.)

In the case where the web page generated by the company is viewed on a computer, a QR Code would be appropriate to present. When constructing the QR code, it should contain a URL and follow this format: mirp://<server host name>&user=<Username>&pin=<PIN> Example: mirp://your.server.rock.com&[email protected]&pin=4444

It is recommended that the web page created by the administrator to provide a QR code also provides the instructions to download the app from the iTunes App Store or Google Play and the instructions to scan the QR code.

In the case where the web page is viewed on the device where Ivanti Mobile@Work is being registered, a URL link would be appropriate.

Implementing infrastructure for QR code with device PIN

The below procedure works for iOS devices and utilizes the PIN code as part of the registration.

1. Enable the PIN code registration

Procedure

Go to Settings > Users & Devices > Device Registration.

Select the appropriate field for the type of Android device:

For unmanaged Android devices, change the In-App registration requirement to Registration PIN.

For managed Android devices, change the Zero Touch and Samsung Knox Mobile Enrollment field OR the Managed Devices / Device Owner (afw#, QR code, NFC) field to Registration PIN.

2. Enable the QR code integration

Procedure

Go to Settings > Users & Devices > Device Registration.

Select on Templates tab > Registration Templates.

Select your language and then select the Edit button.

In the Registration Email section, PIN field, replace the default text with this code: <li>Registration PIN: $PASSCODE$ (valid for $PASSCODE_TTL$ hours) Or Scan the QR Code: <img id='barcode' src="https://api.qrserver.com/v1/create-qr-code/?data=mirp%3A%2F%2F$SERVER_URL$%26user%3D$USER_ID$%26pin%3D$PASSCODE$" width="200" height="200" />

Select Save. When this code has been added, administrators can directly register a device from the Device Registration screen in Ivanti EPMM and / or the device user can initiate the registration from the e-mail invitation.

Registering using a web page on a desktop computer

Below is a sample implementation where the web page is viewed on a desktop computer.

Procedure

Ivanti EPMM administrator sends device user an email with a link to the company's webpage.

In the email, the device user taps on the link. The link opens to the company web page displaying a QR code on it.

On the user's device, the user goes to the iTunes App Store or Google Play and downloads Ivanti Mobile@Work.

User launches the phone's camera.

The Scan QR Code page may open. Device users will need to allow access to the device camera for scanning the QR code. Tap on Open Settings, slide the camera on, then return to Ivanti Mobile@Work.

User scans the QR code that is on the web page. The Ivanti Mobile@Work login page opens with the username, server address and PIN/password fields populated.

If the PIN field is not automatically populated, the device user will need to manually enter it.

User taps Go or Register and continues the registration process.

Note:

On launching the Ivanti Mobile@Work app, the user can tap on the QR code icon (to the right of the user name field), and launch the in-app camera. This camera can then be used to scan the QR code and continue with the registration process.

On devices running iOS 11.0 or later, the native camera can be used to scan the QR code. Upon scanning the QR code, the device user is prompted to launch Ivanti Mobile@Work. Tapping on the prompt launches Ivanti Mobile@Work with the device user’s credentials filled in. The device user can then tap Go or Register to continue with the registration process.

On devices running iOS 10, the native camera lacks the ability to scan QR codes. To work around this, the device user can launch the Ivanti Mobile@Work app, tap on the QR code icon (to the right of the user name field), and launch an in-app camera. This camera can then be used to scan the QR code and continue with the registration process.

Registering using a web page on an iOS device

Below is a sample implementation where the web page is viewed on an iOS device.

Procedure

Administrator sends device user an email with a link to the company's web page.

In the email, the device user taps on the link. The company's web page opens displaying two links.

Device user taps on the first link and downloads the Ivanti Mobile@Work app from the iTunes App store or from Google Play.

Device user taps on the second link, the Ivanti Mobile@Work login page opens with the username, server address and PIN/password fields populated.

If the PIN field is not automatically populated, the device user will need to manually enter it.

User taps Go or Register and continues the registration process.

Customized registration using SAML IdP

Prerequisites

You must have SAML enabled. See "Configuring SAML/IdP support" in the Ivanti EPMM System Manager Guide.

Procedure

Enable SAML in the System Manager.

Configure an identity provider.

In the Admin Portal, go to Settings > Users & Devices > Device Registration page.

In the Apple Web-based Registration Requirement field, select SAML-based registration. If this field is not selected, there will be no change in the registration.

Once SAML on iReg or DEP is set, SAML configuration from the System Manager can be either disabled or deleted. You must first de-select the "SAML-based registration" check box in the Device Registration page in Ivanti EPMM before you can disable the IdP SAML connection in the System Manager.

Select Save.

Users register additional devices

Once a device has been registered, an authorized user can use the user portal to register additional devices without administrative help. This is often used with adding devices for users who do not require assistance.

Prerequisites

Users must have the User Portal role assigned, with the Device Registration option enabled.

The user needs to know the following information for the device:

phone number (if any)

country

platform

Related topics

Self-service User Portal

Administrator registers ActiveSync devices

If you have a Sentry configured, then you can see the devices that are connecting to your ActiveSync server. To incorporate these devices into your Ivanti EPMM inventory, you can use the Register button in the ActiveSync Associations screen. This is often used with devices accessing email via ActiveSync.

Prerequisites

Sentry must be installed and configured.

The user (local or LDAP) associated with the device must be available for selection at the time of registration.

For iOS, Android, and Windows devices, the User Portal role must be assigned to the user.

You need to know the following information for the device:

phone number (if any)

country code

platform

Related topics

ActiveSync device registration

Registering an Apple TV

You can register an Apple TV to Ivanti EPMM only through Apple Configurator.

Prerequisites

The Apple TV must be connected to your corporate network. You can do this by configuring Wi-Fi on the Apple TV or connecting the Apple TV to your Ethernet.

Procedure

Follow the instructions in Distributing MDM Profiles with Apple Configurator.

Using the Apple TV Assistant to import the MDM profile results in an error message. Cancel out of the Apple TV Assistant.

You can do the following when you manage an Apple TV with Ivanti EPMM:

View device information.

Distribute Wi-Fi profiles to the Apple TV.

Retire the device.

Registration via user portal

The user portal can be used to streamline the registration process. See Self-service User Portal for more information.