Best Practices
-
'Default' profiles are automatically applied to a device if no custom profile exists for the device. Endpoint Manager ships with default profiles for each supported operating system, but you can also mark any custom profile as 'default' if you wish.
See Manage Default Profiles for more information.
-
Though it is possible to save all settings in a single profile, an option worth considering is to create separate profiles dedicated to the implementation of a single setting group. You can apply multiple profiles at once to a device or group. For example, you could name a profile 'Android_passcode_profile' and configure only the passcode rules. You could create another called 'Android_VPN_settings' and so on. Adding or removing a profile from a device would let you quickly troubleshoot if a particular setting is causing issues.
See Create Configuration Profiles for more details.
-
Each license allows you to enroll one mobile device or one Windows / Mac / Linux endpoint for a single user. You will need additional licenses for each device you add for a user. We encourage admins to evaluate the average number of devices per user and to set max. enrollments accordingly.
See Enroll User Devices for Management for more details.
-
Creating a group of devices is a great time-saver if the policies applied to them are going to be the same.
See Manage Device Groups for more details.
-
The first level of defense on any device is to set a complex passcode policy. Endpoint Manager allows you specify passwords which are a combination of numbers, letters, special symbols and of a minimum length set by you. You can also set passcode lifetimes, reuse policy and define whether data should be automatically wiped after a certain number of failed logins.
-
Decide what restrictions are required for your company and your users. For example, disabling cell-phone cameras might be expected and mandatory in certain corporate environments but could be seen as a savage affront to liberties in more relaxed offices. Endpoint Manager offers flexible restrictions for Android devices over items such as Wi-Fi, packet data, bluetooth connectivity and use of camera. iOS restrictions are much more granular and also include App purchases, game center, voice dialing and more.
See Profiles for Android Devices and Profiles for iOS Devices for more details.
-
Keeps an eye on the apps you allow in your organization. Apps can be useful and productive to your employees but some may pose a malware or data-leak risk for your organization. EM provides you the ability to blacklist and whitelist apps, to govern how apps behave and to determine whether users are allowed to install apps from 3rd party vendors.
See Applications for more details.
8. Keeping enrolled devices free from malware is vital to your organization's security. It is advisable to run antivirus scans on devices regularly per your company's needs. EM allows you to create a scheduled antivirus scan profile that automates the process of AV scans. If needed, AV scans can also be run instantly for selected devices or all enrolled devices.
9. You can create custom roles for users which determine their permissions within Endpoint Manager. See Configure Role-Based Access Control for Users for more details.
10. Keep on top of your devices. Check device status regularly for compliance with deployed profiles, and take advantage of Endpoint Manager's detailed reporting system. See The Dashboard and Manage Devices and Security Dashboards or more details.