Ivanti EPMM 12.6.0.0 - What's New

4 min

General features

Dual Certificate Support for Sentry-Tunnel Communication: To mitigate service disruptions caused by certificate expiration, a new Upload Certificate 2 field is introduced. This enhancement allows administrators to upload and link two certificates, a primary and a secondary (reserve) to a Sentry profile. This ensures uninterrupted Tunnel-to-Sentry communication. When Certificate 1 expires, Certificate 2 is automatically promoted as the new Certificate 1, and the expired Certificate 1 is automatically deleted from Ivanti EPMM. This feature is available starting from the following Ivanti product versions:

Enhanced options for Network Relays: Administrators can now include and exclude Fully Qualified Domain Names (FQDNs) in the Network Relays. For more information, see Network Relay in Ivanti EPMM Device Management Guide.

Enabling Ivanti Apps@Work for compliance: Administrators can now enable or disable the integrated Ivanti Apps@Work when a device falls out of compliance. For more information, see Compliance actions policy violations in Ivanti EPMM Device Management Guide.

New setting Allow soft reboot added to system manager: New setting added to MICS > Maintenance > Reboot > Allow soft reboot. This settings allows the admin to enable or disable the CTRL+ALT+DEL action on the system and manage reboot action. On fresh installations and upgraded instances, the Allow Soft Reboot setting is disabled by default. When this setting is disabled, the Ctrl+Alt+Del action does not trigger a system reboot. For more information, see Reboot in Ivanti EPMM Device Management Guide.

New sub-roles added to the Device management section: The Add Company device and Add Employee device sub-roles are added to the Device Management > Add Device field. This allows the admins to assign permission as per the assigned device roles. For more information, see Add device roles in Ivanti EPMM Device Management Guide.

Enhanced automated retire action: New option Send Wipe to Devices is added to the Settings> System settings> Automated Device Cleanup section for both Android and iOS devices. The admins can wipe an eligible device if it has not checked-in for N number of days. The following devices are supported:

For Android: Fully managed (Device Owner), Managed Device with Work Profile (Comp), and Android Open Source Project (AOSP).

For Apple: iOS, macOS, and AppleTV devices enrolled via Apple Device Enrollment Program. For more information, see Automated Device Cleanup in Ivanti EPMM Device Management Guide.

Support for SAML based registration in Android devices: Administrators can now authenticate and enroll Android devices using SAML based Authentication using Ivanti Mobile@Work 12.6.0.0 or later versions.

Support to securely re-assign Android devices: Ivanti EPMM now supports Secure Re-assignment of Android devices, and the devices will automatically enforce re-authentication and re-assignment after logout, ensuring secure access in shared environments. For more information, see Re-assigning an Android device securely in Ivanti EPMM Device Management Guide for Android and Android Enterprise devices.

Google Play Integrity Certification is now mandatory on Android devices: Ivanti EPMM enforces Play Integrity Certification (previously known as SafetyNet) on all Android Enterprise devices running on EPMM 12.6.0.0 or later, which assess the security and compatibility of Android devices using Google’s Play Integrity APIs. Also, under Settings > Users&Devices > device registration, for Certified, a new option Hardware Backed: Device is using hardware backed security features is added. For more information, see MEETS_STRONG_INTEGRITY in the Google Play documentation.

The SafetyNet API is deprecated and not supported by Google. If the device fails minimum SafetyNet attestation then the device is wiped or retired.

For more information, see Registration considerations in the Ivanti EPMM System Manager Guide.

macOS support for Microsoft Azure Tenant: Administrators can now grant access to Microsoft 365 apps for macOS devices. For more information, see Azure Tenant in the Ivanti EPMM Device Management Guide for Apple devices.

Enhanced Software Update Enforcement: Ivanti EPMM can now automatically enforce the latest version of the OS on the devices based on the existing build number and the model of the devices after a new version of the OS is released. For more information, see Managing Apple Declarative Device Management in the Ivanti EPMM Device Management Guide for Apple devices.

Support for Ethernet configuration: Ivanti EPMM now supports the configuration of Ethernet connectivity only through networks defined in configuration policies to enhance security by ensuring devices connect solely to trusted Ethernet environments and thereby reducing the risk of unauthorized network access or data interception. For more information, see Ethernet Settings in Ivanti EPMM Device Management Guide for Apple devices.

Support for new skip keys added for iOS devices: The following skip keys are added for iOS devices:

Support for new skip key added for macOS devices: New skip key added for macOS devices:

MAC Address Randomization for macOS: On macOS 15 and later devices, the administrator can now enable or disable the MAC Address Randomization for the Wi-Fi configuration. This option is enabled by default. If the MAC Address Randomization is not selected, the randomization type is not pushed; the Wi-Fi and Inventory MAC Address are the same for a device.

New Script tab added to the Policies & Configs section: The admins can now add a script by uploading script file or adding the script content directly and can edit or delete the scripts, these scripts can be distributed to macOS devices through Policies & Configs > Configurations > Apple > iOS/macOS > Scripts via Declarative Management configuration. Scripts were earlier supported on EPMM through Mobile@Work macOS script configuration and now it is supported through Declarative Management configuration. For more information, see Managing Scripts in the Ivanti EPMM Device Management Guide for Apple devices.

Only Bash, .zsh, Python, and Swift scripts are supported.

The Scripts tab is available when Admin> Actions> Edit Roles> Script Management> Manage Scripts option is enabled.

Preserve Data Plan option enabled by default: The Preserve Data Plan (iOS 11 and later devices only) option on the wipe device screen is now enabled by default.