--- title: Setup tasks slug: epmm/getting-started-guide/setup-tasks createdAt: 2026-10-06T07:50:24.641Z --- This section includes the following setup tasks: - [Setting the enterprise name](docId\:zSkptZQmgybNOs-35QmqB) - [Setting the external hostname](docId\:zSkptZQmgybNOs-35QmqB) - [Setting the idle timeout for the Admin Portal and user portal](docId\:zSkptZQmgybNOs-35QmqB) - [Setting the EULA or other login text](docId\:zSkptZQmgybNOs-35QmqB) - [Enabling last login information display](docId\:zSkptZQmgybNOs-35QmqB) - [Enabling Notes for Audit Logs](docId\:zSkptZQmgybNOs-35QmqB) - [Trusted certificates management](docId\:zSkptZQmgybNOs-35QmqB) - [Uploading your MDM certificate](docId\:zSkptZQmgybNOs-35QmqB) - [Enabling iOS MDM support](docId\:zSkptZQmgybNOs-35QmqB) - [Requesting an MDM certificate](docId\:zSkptZQmgybNOs-35QmqB) - [Confirming MDM for a macOS or iOS device](docId\:zSkptZQmgybNOs-35QmqB) - [Denying check-Ins for devices having expired MDM certificates](docId\:zSkptZQmgybNOs-35QmqB) - [Displaying a report of devices having expired MDM certificates](docId\:zSkptZQmgybNOs-35QmqB) - [Setting a System Event to be notified about certificate expiration](docId\:zSkptZQmgybNOs-35QmqB) - [Renewing your MDM certificate](docId\:zSkptZQmgybNOs-35QmqB) ## Setting the enterprise name The company name entered during Ivanti EPMM installation is used as the default enterprise name identifying your organization in email, SMSes, alerts, and certificates. If the company name you entered is not the one you want to use in these contexts, you can change the name. :::hint{type="info"} Be sure to set the enterprise name before you upload certificates, or you may impact all registered devices. ::: **Procedure** 1. Log in to the Admin Portal. 2. Go to **Settings **>** System Settings** > **General **> **Enterprise**. 3. In the **Enterprise Name** field, enter the text to use when referring to the enterprise. 4. Click **Save**. ## Setting the external hostname The external hostname is set during installation. It is used in the registration URL sent to users for completing the registration process. It is also used in self-signed certificates. Impact: Changing this field requires the following: - Regeneration of any self-signed certificates or uploading matching portal-HTTPS and client-TLS certificates - Rebooting the appliance Procedure 1. Log in to the Admin Portal. 2. Go to **Settings **> **System Settings** > **General **> **Enterprise**. 3. In the **External Host** field, enter the fully-qualified domain name to be used for accessing Ivanti EPMM. 4. Click **Save**. ## Setting the idle timeout for the Admin Portal and user portal Based on your security requirements, you can decide how much idle time is allowed before an administrator or user is automatically logged out of the Admin Portal or self-service user portal. You configure the idle session timeout in the Admin Portal at Settings > System Settings > General > Timeout. You can choose an idle timeout between 5 and 90 minutes. A pop-up warns the administrator or user about the impending timeout a few minutes before the configured idle time elapses. Figure: Idle time out window ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/ZeXFYPgyVDklWBHm0ckaq_idletimeoutdetected.png" position="flex-start" size="64" width="445" height="174" initialPath="../Resources/Images/IdleTimeoutDetected.png" githubPath="Getting Started Guide/Resources/Images/IdleTimeoutDetected.png" darkWidth="445" darkHeight="174" showCaption="false"} When the time elapses, the administrator or user is logged out. If the administrator or user clicks Extend session, the timer is reset. :::hint{type="info"} Changing the idle timeout impacts all future logins. It does not impact your current session. ::: ### Setting the idle timeout for CLI and SSH sessions You can set the idle timeout for command line interface (CLI) and secure shell (SSH) sessions in Ivanti EPMM System Manager. For details, see “System Settings” in the Ivanti EPMM System Manager Guide. ### Warning period details The pop-up that warns that the administrator or user will be logged out precedes the timeout as follows: Table: Add VLAN Fields | Configured idle timeout | Pop-up warning appearance | | ----------------------- | ------------------------- | | 5 to 35 minutes | 3 minutes before timeout | | 40 or 45 minutes | 4 minutes before timeout | | 50 or 55 minutes | 5 minutes before timeout | | 60 or 65 minutes | 6 minutes before timeout | | 70 or 75 minutes | 7 minutes before timeout | | 80 or 85 minutes | 8 minutes before timeout | | 90 minutes | 9 minutes before timeout | ## Setting the EULA or other login text You can configure Ivanti EPMM to display an End User License Agreement (EULA) or any other text on the following user interfaces: - Admin Portal login screen - System Manager login screen - A CLI session - The Self-service user portal login screen **Procedure** 1. In the Admin Portal, go to **Settings **> **System Settings** > **General **> **Login**. 2. Select **Enable Login Text Box**. 3. In **Text To Display**, enter the text. :::hint{type="info" indent="1"} Ivanti EPMM treats the text as plain characters. It does not recognize, for example, HTML tags. The text must be ASCII only; no multi-byte characters are allowed. ::: 4. Click **Save**. The Admin Portal and the System Manager display this text the next time a user logs in. :::hint{type="info" indent="1"} The Ivanti EPMM CLI command banner, available in CLI CONFIG mode, also sets this text. ::: To disable this setting: 1. In the Admin Portal, go to **Settings **> **System Settings** > **General **> **Login**. 2. Uncheck **Enable Login Text Box**. The text you had entered in Text To Display is grayed out. 3. Click **Save**. The login screens and CLI session do not show the text the next time a user logs in. ## Enabling last login information display You can enable a setting to show the current Admin Portal user some login information about the last login to the Admin Portal. This information provides you security insight about Admin Portal use. The information displays when you click on the user icon at the top right of the screen. An example of the information is: Last login was 3/11/2014 1:28:52 PM from 171.15.10.221 The information includes: - the date of the last login - the time of the last login - the IP address of the computer that was used for the last login To configure this setting: 1. In the Admin Portal, go to **Settings **> **System Settings** > **General **> **Login**. 2. Select **Always Show Last Login**. 3. Click **Save**. The Admin Portal displays the last login information the next time a user logs in. ## Enabling Notes for Audit Logs As a best practice, we recommend enabling Notes for Audit Logs. This is used for tracking changes to labels made by administrators. By default, this feature is disabled. When enabled, administrators will be prompted with a text box similar to the one below. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/18CPilmxMd5BY2u-XwIOT_reasonpopup.png" position="flex-start" size="77" width="539" height="424" initialPath="../Resources/Images/ReasonPopup.png" githubPath="Getting Started Guide/Resources/Images/ReasonPopup.png" darkWidth="539" darkHeight="424" showCaption="false" indent="1"} For example, an administrator can enter a change ticket order number, thus allowing for automated monitoring of the Ivanti EPMM environment. This information is then displayed in the Audit logs, in the Details column as "Reason." ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/kFh0pF7xS5XBwdQnGXbop_logsaudit-logsdisplayed.png) Notes for Audit Logs is applicable for the following label-related activities: - Add/Edit/Delete/Save Label (Both filter and manual) - In the Devices & Users > Devices > Advanced Search > Save to Label - Add/Edit/Remove Label to devices - Add/Edit/Remove Label to configurations - Add/Edit/Remove Label to policies - Add/Edit/Remove Label to apps - Add/Edit/Remove Label to iBooks Using this feature, you can also track administrator-made changes to iOS and macOS restrictions. Whenever an administrator adds, edits or deletes iOS and macOS restriction(s), a text dialog box displays for the administrator to enter a reason for the change. For more information about restrictions, see the Ivanti EPMM Device Management Guide for Apple devices. **Procedure ** To set the tracking of changes made by administrators: 1. Go to **Settings **> **System Settings**. 2. In the left pane, click **General **> **Notes for Audit Logs**. The Notes for Audit Logs page opens. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/jvrZJJ2m_azIwpi0qZsBK_notes-for-audit-logs.PNG" position="flex-start" size="100" width="1407" height="521" initialPath="../Resources/Images/Notes for Audit Logs.PNG" githubPath="Getting Started Guide/Resources/Images/Notes for Audit Logs.PNG" darkWidth="1407" darkHeight="521" showCaption="false" indent="1"} 3. Select **Enable Notes for Audit Logs **and then click **Save**. ## Trusted certificates management Ivanti EPMM uses TLS/SSL to secure incoming and outgoing connections to outside entities, such as servers, clients, and Sentry. Clients connecting to a server over TLS/SSL are required to verify the server certificate chain obtained during the TLS/SSL handshake. To ensure these connections are secure, Ivanti EPMM verifies the certificate chain and server hostname, and checks the certificate against the Certification Revocation List (CRL). The Trusted Certificates feature provides administrators with the ability to: - Check the CRL: This ensures that verification information is current by checking certificates (trusted and new) against obtained CRLs. Certificate validity periods are checked against the current time provided by the verifier's system clock. - Verify signatures: These are verified using the public key in the issuer's certificates. - Verify the certificate chain: This ensures the certificate chain is well-formed, valid, properly signed, and trustworthy. Certificate chain verification stops at trusted anchor certificate stored by Ivanti EPMM. - Verify server hostname: This verifies the server's hostname against names included in server certificate. The trusted certificate feature has the following settings: - Allow only TLS/SSL connections certified by trusted CAs: This setting provides the highest level of security using the TLS/SSL protocol. Administrators manually enable the configuration of trusted certificates with additional preferences for server hostname verification and revocation status validation based on the Certification Revocation List (CRL). - Allow all TLS/SSL connections and register certifying CAs as trusted: This setting adds all connections to the Show Trusted Certs table. This action creates a migration path where administrators can review details of each certificate and manually turn on TLS/SSL over time. - Allow all TLS/SSL connections: This is the default setting and allows all outgoing connections after verifying the Issuer, Subject, Signature, and Validity status. ### Configuring trusted certificate settings Ivanti EPMM allows you to configure any of the following trusted certificate settings: - Allow only TLS/SSL connections certified by trusted CAs. This setting allows administrators to manually configure trusted certificates and allows them to disable the server hostname and revocation status verification. Revocation status validation is based on Certification Revocation List (CRL) that are automatically downloaded and verified. The CRL grace period is configurable with a default value of 30 minutes. - Allow all TLS/SSL connections and register certifying CAs as trusted. This setting automatically adds all required certificates to the trusted certificate table available for review in the Admin Portal. This allows administrators to turn on TLS/SSL instantly. - Allow all TLS/SSL connections. This setting allows all outgoing connections, providing basic certificate chain verification including certificate names, signatures, and validity. :::hint{type="info"} Switching among these TLS/SSL settings requires you to restart Ivanti EPMM for your changes to take effect. ::: **Procedure ** 1. From the Admin Portal, go to **Settings **> **System Settings** > **Security **> **TLS/SSL** to open the trusted certificate settings window. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/3Kgi4ax_t1QlBF02LVByD_tlssslpreferences.png" position="flex-start" size="95" width="666" height="425" initialPath="../Resources/Images/TLSSSLPreferences.png" githubPath="Getting Started Guide/Resources/Images/TLSSSLPreferences.png" darkWidth="666" darkHeight="425" showCaption="false" indent="1"} 2. Select *one *of the following settings. 1. **Allow only TLS/SSL connections certified by trusted CAs:** This setting allows administrators to manually configure trusted certificates and allows them to disable the server hostname and revocation status verification. Revocation status validation is based on Certification Revocation List (CRL) that are automatically downloaded and verified. The CRL grace period is configurable with a default value of 30 minutes. 2. **Allow all TLS/SSL connections and register certifying CAs as trusted: **This setting automatically adds all required certificates to the trusted certificate table available for review in the Admin Portal. This allows administrators to turn on TLS/SSL instantly. 3. **Allow all TLS/SSL connections**: This setting allows all outgoing connections, providing basic certificate chain verification including certificate names, signatures, and validity. 3. Click **Save**. ### Managing trusted certificates Depending on how trusted certificates are configured, Ivanti EPMM adds trusted and untrusted root certificates to the Admin Portal. The procedures in this section describe how to manage the information in these tables. This section contains the following procedures: - Delete a certificate. - Trust an untrusted certificate. - Add a trusted certificate. - View certificate details. To delete a certificate: 1. From the Admin Portal, go to **Services **> **Trusted Root Certificates**. 2. Click the drop-down box to the right and select one of the following options: 1. **Show Trusted Certs** 2. **Show Untrusted Certs** 3. Select one or more certificates. 4. Select **Actions **> **Delete**. 5. Click **Yes **in the confirmation box. **IMPORTANT**: You must restart the server to complete the process of deleting the selected trusted certificates. ### To trust an untrusted certificate: 1. Log in to the Admin Portal and select **Services **> **Trusted Root Certificates**. 2. Click the drop-down box and select **Show Untrusted Certs**. 3. Click the **View Certificate** link for the certificate you want to trust. You can select only one certificate at a time to allow you to review each certificate individually. 4. Review the certificate information and click **Close **when you have completed the review. 5. Select **Actions **> **Trust**. 6. Review the trust certificate. 7. Click **Trust if you want to continue or Cancel**. ### To add a trusted certificate: 1. Log in to the Admin Portal and select **Services **> **Trusted Root Certificates**. 2. Click the drop-down box and select **Show Trusted Certs**. 3. Click **Add+**. 4. Add the certificate to the File box using the **Browse **button. 5. Click** Upload Certificate**. 6. Click **OK**. ### To view certificate details: 1. Log in to the Admin Portal and select **Services **> **Trusted Root Certificates**. 2. Click the drop-down box to the right and select one of the following options: 1. **Show Trusted Certs** 2. **Show Untrusted Certs** 3. Click the **View Certificate** link for a single certificate. 4. View the certificate details, then click **Close**. ## Importing untrusted certificates Ivanti EPMM fails to connect to a service if both of the following are true: - On **Settings **> **Security **> **TLS/SSL**, you have selected **Allow only TLS/SSL connections certified by trusted CAs**. - Ivanti EPMM does not trust at least one Certificate Authority (CA) in the certificate chain that the service presents to Ivanti EPMM. This failure can occur for: - Services listed on **Services **> **Overview**. - Additional services you use, such certificate providers configured in certificate enrollment settings. On a new Ivanti EPMM installation, to simplify the process to trust the services listed on Services > Overview, Ivanti recommends the following procedure: **Procedure ** 1. On **Settings **> **Security **> **TLS/SSL**, select **Allow all TLS/SSL connections and register certifying CAs as trusted**. 2. Verify your connections with the backend services by selecting Verify All in Services > Overview. Ivanti EPMM imports the certificate chains, which will now appear in Services > Trusted Root Certificates. 3. On **Settings **> **Security **> **TLS/SS**L, select **Allow only TLS/SSL connections certified by trusted CAs**. 4. To trust additional certificates, follow the procedure in [Managing trusted certificates](docId\:zSkptZQmgybNOs-35QmqB). ## Managing Mobile Device Management (MDM) certificates for iOS and macOS This section includes the following topics: - [Requesting an MDM certificate](docId\:zSkptZQmgybNOs-35QmqB) - [Uploading your MDM certificate](docId\:zSkptZQmgybNOs-35QmqB) - [Enabling iOS MDM support](docId\:zSkptZQmgybNOs-35QmqB) - [Confirming MDM for a macOS or iOS device](docId\:zSkptZQmgybNOs-35QmqB) - [Denying check-Ins for devices having expired MDM certificates](docId\:zSkptZQmgybNOs-35QmqB) - [Displaying a report of devices having expired MDM certificates](docId\:zSkptZQmgybNOs-35QmqB) If you are using only MAM-only iOS devices, skip these MDM-related sections. For more information, see “Managing apps on MAM-only devices” in the Ivanti EPMM Apps\@Work Guide. ### Requesting an MDM certificate You can request an MDM certificate from Apple. **Prerequisite** When using the option Allow only TLS/SSL connections certified by trusted CAs as selected in [Configuring trusted certificate settings](docId\:zSkptZQmgybNOs-35QmqB), make sure that all certificates listed in Services > Trusted Root Certificates are trusted. To trust certificates, see [Managing trusted certificates](docId\:zSkptZQmgybNOs-35QmqB). **Procedure ** 1. Log in to the Admin Portal and select **Settings **> **System Settings**. 2. Select **iOS **> **MDM**. 3. Select the **Enable MDM Profile** option. 4. Click **Install MDM Certificate**. The MDM Certificate Generation window displays. 5. Click **Download Certificate Signing Request**. If an empty text file downloads, see the steps in **Before you begin**. Otherwise, this step generates the required property list in Apple’s .PLIST XML format. This may take a few minutes. 6. Select a location for the plist when prompted. The downloaded file is req-plist.txt. 7. Click the **Apple Push Certificates Portal** link to start the process of requesting the MDM certificate. 8. When you receive the MDM certificate from Apple, click **Upload MDM Certificate**. The Upload MDM Certificate dialog appears. 9. Click **Upload Certificate**. ### Uploading your MDM certificate If you have already requested and received your MDM certificate from Apple, you can upload the certificate using the following steps: **Procedure ** 1. Log in to the Admin Portal. 2. Go to **Settings **> **System Settings**. 3. Select **iOS **> **MDM**. 4. Select the **Enable MDM Profile** option. 5. Click** Install MDM Certificate**. 6. Select **I already have an MDM Certificate, and want to upload it**. 7. Click **Display Upload Certificate Form**. 8. Click **Choose File**. 9. Click **Upload Certificate**. ### Enabling iOS MDM support Once you have completed all steps required by Apple, you can enable iOS MDM support in Ivanti EPMM. See the following source for information on Apple’s current program: [http://www.apple.com/ipad/business/integration/mdm/](http://www.apple.com/ipad/business/integration/mdm/) Ivanti EPMM uses Apple’s enhanced MDM certificate infrastructure to streamline the process of acquiring and uploading an MDM certificate. You can now complete the following tasks from a single screen within the Admin Portal: - generate a Certificate Signing Request (CSR) - upload the CSR - access the Apple Push Certificates Portal to request a certificate - upload the MDM certificate If you already have an MDM certificate, but have not uploaded it, you can upload it from the same screen. If you enabled iOS MDM support in a previous Ivanti EPMM release, then you should not use the enhanced certificate infrastructure at this time unless otherwise instructed by Apple or Ivanti EPMM. Doing so will disable your current certificates for all registered Mac iOS devices. :::hint{type="info"} If you intend to develop in-house apps for distribution, then you still need to participate in Apple Device Enrollment. For more information about participating in Apple Device Enrollment, see “Managing Devices Enrolled in the Apple Device Enrollment Program” in the Ivanti EPMM Device Management Guide for Apple devices ::: ### Confirming MDM for a macOS or iOS device To confirm that MDM is operational for a macOS or an iOS device: **Procedure ** 1. Log in to the Admin Portal and select Device & Users > Devices. 2. Select any iOS device and click the up arrow to expand the device details. 3. In the Device Details tab, confirm that the MDM Operational flag value is Yes. ### Denying check-Ins for devices having expired MDM certificates By default, Ivanti EPMM allows macOS and iOS devices with expired MDM certificates to check in. You can, however, configure Ivanti EPMM to deny check-ins to these devices. **Procedure ** 1. Log in to the Admin Portal and select **Settings **> **System Settings**. 2. Select **iOS **> **MDM**. 3. In the MDM Preferences section, clear the **Permit expired client certificate** option. 4. Click **Save**. ### Displaying a report of devices having expired MDM certificates You can save to a CSV file a list of the iOS or macOS devices with expired MDM certificates. **Procedure ** 1. Log in to the Admin Portal and select **Settings **> **System Settings**. 2. Select **iOS **> **MDM**. 3. Click **Download Expired MDM Certificate Devices Report**. 4. Open or save the resulting CSV file. ### Setting a System Event to be notified about certificate expiration You can be notified of the pending expiration of your iOS MDM certificate 30 days before its expiry. **Procedure ** 1. Log in to the Admin Portal and select **Logs **> **Event Settings**. 2. Click **Add **New > **System Event**. 3. Enter a name for the **System Event**. 4. Ensure **Certificate Expired** is selected. 5. Select other options according to your requirements. 6. In the **Send Alerts** section, under **Apply to Labels**, do **not** select a label. 7. In the **Search Users **field, enter the user ID of an administrator who has a device registered on Ivanti EPMM. 8. Select the administrator in the** Apply to Users** list. 9. Click the right arrow to move the administrator to the **Selected **list. 10. Click **Save**. **Related topics**:  "System event settings" in the Ivanti EPMM Device Management Guide for Apple devices. ### Renewing your MDM certificate Renew your MDM certificate before it expires. This procedure uses the Ivanti EPMM Admin Portal and the Apple Push Certificates Portal. You need the Apple ID that was originally used to create the MDM certificate. If you don't know what Apple ID to use, open a ticket with Apple Developer Program Support. - Do not use Internet Explorer for this procedure. - Apple might change the steps involving the Apple Push Certificates Portal. **Procedure ** 1. Log in to the Ivanti EPMM Admin Portal and select **Settings **> **System Settings**. 2. Select **iOS **> **MDM**. 3. Click **Install MDM Certificate**. 4. Click** Download Certificate Signing Request**. 5. Note to where the file is downloaded. 6. Click **Apple Push Certificates Portal**. 7. Log in to the Apple Push Certificates Portal using the same Apple ID that was used to create the certificate. 8. In the **Apple Push Certificates Portal**, you will see your MDM certificate. 9. Click **Renew**. 10. Click **Choose File** and find the txt file that you downloaded. 11. Click **Upload**. 12. When you see the confirmation screen, click **Download**. The renewed certificate, a PEM file, downloads. 13. In the Ivanti **EPMM Admin Portal**, in the **MDM Certificate Generation** screen, click **Upload MDM Certificate**. 14. Browse to the PEM file and click **Upload Certificate**. A confirmation screen displays. 15. Click the **X **to close the confirmation screen. 16. Click** View Certificate **to note the new date and time on the certificate. **Related topics**: [How To Identify a Matching MDM Cert in the Apple Push Certificate Portal](https://community.mobileiron.com/docs/DOC-2171)