Ivanti EPMM 12.9.0.0 - What's New
3 min
General features
- MTD Anti‑Phishing and Smishing Policy Update: Ivanti EPMM renames the MTD Anti‑Phishing Policy to MTD Anti‑Phishing or Smishing Policy. For the Lookout MTD provider, the policy now includes a new field, Enable Smishing Protection. For more information see, the MTD Anti-Phishing/Smishing Policy section in the Ivanti EPMM Device Management Guide.
- Robust Support for Authentication: Ivanti EPMM now supports only ECDSA SHA‑2 NIST P‑256, P‑384, and P‑521 public key authentication algorithm for SSH. Before upgrading to Ivanti EPMM 12.9.0.0, administrators must replace the existing SSH client authentication public keys with ECDSA SHA‑2 NIST P‑256, P‑384, or P‑521 keys and upload the updated public keys to System Manager. For more information see, the EXEC PRIVILEGED mode command details or CONFIG mode command details section in the Ivanti EPMM Command Line Interface (CLI) Reference Guide.
- Enhanced Server Trust Configuration: This release enhances server-to-server security by introducing a new trust configuration process. Administrators can delete existing managed host entries and configure SSH keys to establish trusted relationships using modern public-key cryptography. For more information see, the High Availability Ivanti EPMM software upgrade procedures section in the Ivanti EPMM High Availability Management Guide.
- Enhanced Device Enrollment Workflow: In the custom Automated Apple Device Enrollment web page workflow, the custom web server must authenticate with an administrator account that has an API role when calling Ivanti EPMM to retrieve the MDM profile. For more information, see Adding a custom Automated Device Enrollment web page in the Ivanti EPMM Device Management Guide.
- Support for Samsung Knox and other device registration on Red Core: In general, iOS devices register in Black Core using HRN mode and later migrated to Red Core whereas Samsung Knox and AOSP devices could directly register in Red Core. In earlier releases, the migration process could overwrite database entries in Red Core. To prevent these data conflicts, Ivanti EPMM now maintains database entries for all device actions and registrations in Red Core by using custom auto-increment values across all tables.
You must complete the first-time migration from Black Core to Red Core before registering Samsung Knox and other devices directly on Red Core.
- LDAP Support for Windows Server 2025: Ivanti EPMM extends LDAP compatibility by adding support for Windows Server 2025 and AD domain functional level 25, enabling organizations to integrate with the latest Active Directory infrastructure.
- Enhanced support for LDAP OU and Group APIs: Ivanti EPMM improves performance and scalability by adding pagination to LDAP OU and Group API calls. This enhancement optimizes data retrieval for Advanced Search and Label Edit workflows, especially in large directory environments. For more information see, the Advanced searching section in the Ivanti EPMM Device Management Guide.
- Enhanced version controlling for Security Policy: Ivanti EPMM enhances security policy configuration by enabling administrators to define iOS or macOS version by manually entering valid OS version or selecting from the drop-down list within the Security Policy. This update improves policy precision and ensures devices comply with the intended OS version standards. For more information see, the Security policies section in the Ivanti EPMM Device Management Guide.
Android features
- Whitelisted App Support for Always‑On VPN in AE Configuration: Ivanti EPMM now supports whitelisted apps in Android Enterprise (AE) configurations when Always-On VPN is enabled. This feature applies to devices running Android 10 and later across all Android registration modes. By configuring a whitelist, you can allow specified apps to bypass the VPN and maintain network connectivity even if the VPN connection becomes unavailable. For more information see, the Enabling Android Enterprise section in the Ivanti EPMM Device Management Guide for Android and Android Enterprise Devices.
- Active SIM Details Reporting for Android Devices: Starting with this release, Ivanti EPMM supports reporting active SIM details for supported Android devices enrolled in EPO, DO, and PO modes. The system adds a new device detail, Active SIMs, which displays the count of active SIMs on the Device Details page. For more information see, the Advanced searching section in the Ivanti EPMM Device Management Guide for Android and Android Enterprise Devices.
- Support to Auto Enable eSIM: In Ivanti EPMM, you can now enable the provisioned eSIM by selecting the Auto Enable eSIM checkbox from eSIM Cellular Plan Policy for Android devices.
- Enhanced Location Service Enablement: Ivanti EPMM now enforces Location Services only when the Enable Location Service option is selected. User prompting for location access is supported on Android 11 and earlier. For Android 12 and later, prompting is not applicable. For more information see, the Privacy policies section in the Getting Started with Ivanti EPMM.
- Addition of Support tab in Ivanti Mobile@Work: Using Ivanti EPMM, administrators can now configure and add the Support Tab in Ivanti Mobile@Work for Android application. For more information see, the Ivanti Mobile@Work Support Tab Policy section in the Ivanti EPMM Device Management Guide.
- URL Support in Support Tab Policy: Ivanti EPMM now includes a Ticket System URL field in the Support Tab Policy. Administrators can configure a URL that links directly to the customer’s support portal. For more information see, the Ivanti Mobile@Work Support Tab Policy section in the Ivanti EPMM Device Management Guide.
iOS and macOS features
- Enhanced Support Tab Policy: You can now create multiple Support Tab Policies in Ivanti EPMM. These policies allow you to display different support details and provide localized content in multiple languages within the Support Tab in the Ivanti Mobile@Work app. For more information see, the Ivanti Mobile@Work Support Tab Policy section in the Ivanti EPMM Device Management Guide.
- Additional Device Details: Ivanti EPMM now displays additional device information about Subscriber MCC 2 and Subscriber MNC 2, for supported devices.
- Support for Certificate Import for Certificate Pinning: Ivanti EPMM now allows administrators to seamlessly import certificates for check-ins and server URLs. Devices use the imported certificates to perform certificate pinning. For more information see, the Editing default iOS MDM settings section in the Ivanti EPMM Device Management Guide for Apple Devices.
- Support for latest iOS update during device enrollment: Ivanti EPMM now allows administrators to enforce the latest iOS version during device enrollment. When administrators select Require Minimum OS version for enrollment and choose Latest Version option, the device must update to the latest available iOS version before completing enrollment. Administrators can also configure a custom message that appears to users during device enrollment. For more information see, the Creating an Apple Device Enrollment Profile section in the Ivanti EPMM Device Management Guide for Apple Devices.
- Enhanced options during device enrollment profile: Ivanti EPMM enhances Device Enrollment Profile (DEP) flexibility by introducing Return to Service and Do Not Use Profile from Backup options in the DEP profile. These options give administrators greater control over how devices enroll and ensure a clean and consistent enrollment experience. For more information see, the Creating an Apple Device Enrollment Profile section in the Ivanti EPMM Device Management Guide for Apple Devices.
- Introduction of Return to Service: Starting with this release, when an administrator selects the Return to Service option in the DEP profile during DEP enrollment, the device returns the bootstrap token. When the administrator later wipes the device by selecting the Return to Service option, the device enters Rapid Return to Service mode during the subsequent DEP enrollment.
- Introduction of Do Not Use Profile from Backup: Ivanti EPMM now supports the Do Not Use Profile from Backup option in the DEP profile. When you select this option, the device prompts the user for MDM enrollment during setup. When you do not select this option, the device restores the MDM profile from the backup. For example,
- After you register a device, if you take an iCloud backup and restore it to another device using the same iCloud account, the MDM profile does not restore from the backup.
- After you register a device, take a backup, and restore it to the same device while associating a DEP profile from another Core instance, the following behaviors occur based on the Do not use profile from backup option:
- If you do not select the checkbox, the device restores with the profile from the backup, and device check-ins function correctly.
- If you select the checkbox, the device prompts for MDM enrollment after the restore.
- Enhanced Return to Service: Ivanti EPMM now supports saving the bootstrap token for iOS devices and returning the token when you wipe the device with Return to Service mode option selected in Ivanti EPMM. This capability enables the device to enroll in Rapid Return to Service mode during subsequent DEP enrollments. For more information see, the Apple Device Enrollment with Ivanti EPMM overview section in the Ivanti EPMM Device Management Guide for Apple Devices.