Ivanti EPMM 12.3.0.0 - What's New

3 min

General features

Support for duplicate LDAP groups: In previous releases, moving LDAP groups from one directory to another generated a duplicate entry. However, from 12.3.0.0 and later versions, an error message displays. The administrator must delete outdated duplicate entries before a sync, to ensure that the new group mapping is updated.

Support for Zimperium v5 console for EPMM: The new v5 Zimperium console is now supported with EPMM 12.3.0.0. Users can now add JSON based threat file and the size of the Zimperium key is now updated to 512 character size.

Android features

Support for a new security policy: New security policy "Require Mobile@Work for captive-portal WiFi authentication" is introduced for Android devices. When this setting is enabled and a user connects to a WiFi through a captive-portal-login, the authentication request is intercepted and processed by Mobile@Work. For more information, see Security Policies in the Ivanti EPMM Getting Started Guide.

This setting overrides the OS behavior which may not allow to establish a session in case the captive-portal provider is not using a trusted or a valid certificate for TLS.

Deprecation of per user workflow for Android Enterprise app distribution: The per user workflow for Android Enterprise app distribution is now deprecated. After upgrading to 12.3.0.0, if you have per user app distribution enabled, then it is defaulted to per device distribution.

Support for case sensitivity for packages in whitelist and blacklist of applications in the Lockdown policy for Android Enterprise: With EPMM 12.3.0.0, case sensitivity is supported for Packages in the Lockdown policy for Android Enterprise under Work Profile on Company Owned Device Mode. Now, when the Package is entered for allowed or disallowed apps, EPMM supports case sensitivity For more information, see Lockdown Policy Fields: Android Enterprise in Work Profile on Company Owned Device Mode in the Getting Started with Ivanti EPMM Guide.

Support for Lost Mode: To enable this feature, navigate to Devices & Users > Action > More Actions > Lost Mode. Administrators can now enable or disable Lost Mode. When the Lost Mode is enabled, options such as send message, phone number, footnote, and provide an option to play sound are available. This is supported for Android 8 and later versions. For more information see Security-related features and tasks in the Ivanti EPMM Device Management Guide for Android and Android Enterprise devices.

Support for restrictions for Android devices: Administrators can now create restrictions for Android devices with a list of Allowed devices with different "Manufacturer Name / Model" combination for Samsung Galaxy devices. If a device is not listed, the following message displays: Error - Unable to complete registration (Invalid Manufacturer or Model). Please contact your administrator.

iOS and macOS features

New parameters added in Software Update Settings: Six new parameters are introduced in the EPMM admin portal > Policies & Configs > Policies > Add New > Apple > iOS / macOS > Software Update Settings. These parameters support software updates on iPhone, iPad, and Mac devices, which can now be managed entirely with Declarative Device Management. These settings replace the MDM profiles for software update restrictions, settings, and software update commands and queries. This policy is supported on iOS 18 and later devices and on macOS 15 and later devices. For more information, see Software Update Settings in the Ivanti EPMM Device Management Guide for iOS and macOS devices.

Support for Two-Factor Authentication for Secure Sign-in Webclip for iOS: Implemented enhanced security through two-factor authentication for the Secure Sign-In Webclip, ensuring compliance with DORA guidelines and protecting user data on multi-user devices. This is applicable to iOS devices only. For more information, see Working with web applications for iOS and macOS in the Ivanti EPMM Apps@Work Guide.

Support for Skipkeys in iOS 18 and macOS 15 and later versions: Skipkeys are now supported to skip the intelligence pane.

Support for eSIM Outgoing Transfers restriction: Administrators can now control eSIM transfer to a newly setup device on iOS 18 and later versions. For more information, see iOS and tvOS restriction settings in the Ivanti EPMM Device Management Guide for iOS and macOS devices.

New fields added to Device Details columns for iOS and MacOS devices: New fields OS Build Version pending for update and OS version pending for update are added to the Devices & Users > Devices > Device details section. The following status items are subscribed from EPMM 12.3.0 release:

softwareupdate.install-reason

softwareupdate.pending-version

softwareupdate.install-state

softwareupdate.failure-reason These statuses are displayed as: Audit log:

Consolidated log having values of install-reason, install-state, and failure-reason under Devices section with action "Software Update (via software update enforcement policy)" Device detail attributes:

OS version pending for update: The OS version that is pending for update on the device

OS build version pending for update: The build version of the OS that is pending for update on the device. For more information, see Advanced searching in the Ivanti EPMM Device Management Guide for iOS and macOS Devices.

Ability to schedule auto app updates (For public iOS apps):The admins can now create, update, and remove the App Auto-Update policy and distribute to set of devices. The App Auto-Update Configuration is supported on public iOS apps. Only single policy per device. Each Auto-Update Config has the following set of values:

(a) Time zone

(b) Start Time

Time zone and the Start time is calculated based on the time zone provided and is not depended on device or server. The Auto-Update applies for managed apps only. Only a Single Configuration is applied to the device, with a priority for the Configuration. For more information, see App update schedule policy in the Ivanti EPMM Device Management Guide for iOS and macOS Devices.

Support for LDAP attributes sync with Managed App Config: With 12.3.0.0, LDAP sync occurs and it pushes the Managed App Config to the device irrespective of where the Managed App Config for any particular app configured to use the XML based Managed App Config from the Configuration tab or Configured to use Managed App Config directly within the AppCatalog. For more information, see "Managing LDAP Users" in the Getting Started Guide.