Securepoint Mobile Security (MS) FAQ

FAQ

Last adaption: 11.2022

notempty

This article refers to a Resellerpreview

-

Before commissioning

Software and Server

Where does the software come from? Do you have to operate your own server?

Answer

Securepoint Mobile Security is a cloud service provided by Securepoint.
Android and Apple mobile devices communicate exclusively with Apple and Google servers, which are addressed by us.
No proprietary software or hardware is required or possible.

MDM and Mobile Security

What is the difference between MDM and mobile security?

Answer

Mobile Device Management (MDM) is device management, app installation, and setting the device settings
Mobile Security (MobSec) is all this PLUS the VPN tunnel to our data center with encrypted communication & content filtering

Recommended Android devices

What Android devices are recommended?

Answer

All devices > Android 7 are officially supported. Securepoint cannot make a direct recommendation here due to the large variety of devices in the Android ecosystem. However, Google provides a collection of devices that have been certified for the API we use: https://androidenterprisepartners.withgoogle.com/devices/

Move device

Can devices be moved from one client to another?

Answer

No, this is not possible fir iOs or Android.

Portal

Delete device

How are devices deleted?

Answer

iOS:

The corresponding device tile is selected via Mobile Security iOS/iPadOS Devices and the Wipe Data button is clicked in the Operations tab to reset the device.
Then delete the corresponding tile when the device reports that it is logged out.

Android:

Android devices are reseted by deleting the device tile.

Windows devices

Can Windows devices also be controlled with the MDM?

Answer

No. MDM can only be used to control devices with the iOS, iPadOS, tvOS or Android operating systems. No Windows.

.apk-Files

Can .apk-Files be installed on an Android device?

Answer

Basically yes, but the use of APK files on the devices is strongly discouraged. The following problems may occur:

Device integrity is lost
No real control over the device
No update channel
No integrity check of the app by the app store

If you still need to install APKs, you can find more information on this in the Wiki article on APKs.

Updates of apps

How are app updates carried out?

Answer

Android: By default, apps are updated automatically if the following conditions are met:

The device is connected to a WLAN.
The device is charging.
The device is inactive (i.e. not being actively used).
The app to be updated is not running in the foreground. Google Play normally checks for app updates once a day. It can therefore take up to 24 hours for an app to be added to the update queue. It will then be updated automatically as soon as the above conditions are met.

iOS:

Apps: Apps are installed automatically every day if the device is registered in the app store. If an installation command for an app is send to a device from the portal and this app is already installed, an app update is carried out immediately.
VPP apps: VPP apps are automatically checked for updates every night and pushed to the devices regardless of the WWAN connection used by the devices. This can be deactivated globally in the portal under Mobile Security Settings Automatic app updates.

Contact from iOS devices

What does Contact mean for iOS devices?

Answer

The integrated iOS devices do not establish independent contact with the portal by default. Contact in the device tile refers to the last time a command is send to the device from the portal and the device has confirmed receipt of the command.

iOS devices without AppleID

Can iOS devices also be used without an AppleID?

Answer

Devices can be operated without AppleID without any problems. This requires the full integration of DEP & VPP. This is the operating mode recommended by Securepoint. Further instructions can be found in our Wiki.

iOS devices do not respond

What to do with iOS devices that do not respond?

Answer

It must be ensured that the devices are switched on and connected to the Internet.
If there is a connection to the Internet, please ensure that communication is not hindered or restricted.
- If necessary, use an access point from a smartphone
Check Apple Push certificate
- Encrypts the connection between the portal and the devices
- Must be renewed annually
- If a new certificate is imported during renewal instead of renewing the old certificate, you will lose communication with the devices that use the old certificate.
- Compare whether the Apple Push certificate in the portal and on the device are the same:
  - Mobile Security Settings at Apple Push Certificate click on the button Update, there under 2. under Here is a list of your last uploads the certificates under UID
  - Device | Settings | General | VPN and device management | Securepoint MDM | More details | Mobile Device Management | Topic
  - These two values must be identical.
If the values are not identical, a new certificate has been uploaded to the portal, which means that the devices can no longer be accessed. The old certificate must be renewed and uploaded again. Devices that have been enrolled with the new certificate must then be re-enrolled.
If the devices cannot be reached despite the correct certificate:
- Is the communication interrupted by a faulty VPN tunnel?
- Is the firewall blocking the communication?
  - Hosts and networks that must be accessible: 17.0.0.0/8, portal.securepoint.cloud, dns-001.securepoint.de, ios.securepoint.cloud
  - Ports that must not be blocked: 53, 80, 123, 443, 2197, 5223

logged off/logged out iOS device

How can a logged off/logged out iOS device log back into the portal?

Answer

Download the .mobileconfig via the Hamburger menu of the device tile in Mobile Security iOS/iPadOS Devices
Connect the device to a macOS
Activate Internet sharing of the macOS to the iOS device

Apple Configurator 2: Actions | Add | Profiles | Select downloaded .mobileconfig | Add

Put the device into manual operation

Website in the stats

Why is not every visit to a website included in the statistics?

Answer

Mobile Security must be used for the statistics. The statistics count calls to the proxy. Data cached by the browser does not appear here.

Streaming services with VPN security function

Why do streaming services such as Netflix or Amazon Prime Video not work when the VPN security function is active?

Answer

Streaming services generally use IP-based geo-blocking to comply with the right to use the content.

If VPN is active, the actual IP address of the dial-in and thus the geographical assignment is not visible to the streaming provider.

This is why many streaming services also block the IPs of data centers.

DEP profiles: next commissioning

What does the display mean for DEP profiles: Will not be applied until the next commissioning?

Answer

The DEP profiles determine the dialogs that are displayed in the installation wizard when the iOS device is started up. To ensure that these are used correctly, they must be assigned before the device is initialized for the first time.

Terms and conditions in the VPN app

Why do the terms and conditions in the VPN app have to be explicitly accepted by the user?

Answer

Both Apple and Google require users to be informed about the use of the data or to give their consent before a VPN service can be used.