MDM Settings

Overview

MDM settings are the standard Android Enterprise policies built into every MDM. They work the same way on Datalogic devices as on any other Android Enterprise device, are reported in the MDM console, and are reapplied by the MDM if they change. Configure a setting here whenever your MDM offers it, rather than in OEMConfig or Scan2Deploy.

For Datalogic-specific settings, such as scanner settings, see OEMConfig. To compare the configuration methods, see Configuration.

Available settings

Every MDM offers a similar set of Android Enterprise settings, although the names and grouping differ. The most useful on Datalogic devices are:

Category	Setting	Use on Datalogic devices
Security	Certificates	Root (CA) certificates to trust your servers and enterprise Wi-Fi, and client certificates to authenticate the device.
	Passcode and authentication	Screen lock and passcode requirements. Usually left off on shared dedicated devices.
	Factory reset protection	Which Google accounts can unlock the device after an unauthorized factory reset.
	System update policy	When Android system updates may install, such as in a maintenance window. Datalogic firmware is updated as described in Firmware Update.
	Single sign-on	Sign-in to work apps with your identity provider, for shared devices with sign-in.
Restrictions	Lockdown (kiosk mode)	Locks dedicated devices to one app or a set of apps, hiding the home screen, status bar, and settings.
	App allow and block lists	Which apps can run on the device, including preinstalled system apps.
	Feature control	Turns device features on or off, such as the camera, Bluetooth, USB file transfer, screenshots, factory reset, and access to Settings.
	Browser, web filter, and proxy	Allowed websites and the proxy used by browsers and apps.
	Phone calls	Allowed incoming and outgoing calls, on WWAN devices.
Connectivity	Wi-Fi	The Wi-Fi networks the device connects to, including enterprise (EAP) networks.
	APN	The cellular access point, on WWAN devices with a private APN.
	VPN	An always-on or per-app VPN to reach internal servers.
Apps and device	Managed Google Play apps	Installs and updates apps, and sets their managed configuration. Datalogic apps, such as Datalogic OEMConfig, are deployed this way.
	Device inactivity	Screen timeout and lock after a period of inactivity.
	Date, time, and time zone	Time zone and time server, so that logs and transactions use the correct time.
	Wallpaper, bookmarks, and email	Branding, browser bookmarks, and work email accounts.

The procedure below walks through the three settings almost every Datalogic deployment needs: certificates, Wi-Fi, and lockdown. Other settings are added to the same profile in the same way.

Before you begin

• Enroll the devices as fully managed (device owner) devices. See Enrollment.
• For enterprise (EAP-TLS, PEAP) Wi-Fi networks, have the root (CA) certificate of your authentication server, and the client certificate if required. Deploy the certificates before, or in the same profile as, the Wi-Fi network that uses them.
• To lock devices to a set of apps, deploy the apps to the devices first.

Procedure

SOTI MobiControl

These steps are based on SOTI's Android Enterprise profile configurations guide.

SOTI MobiControl groups the configurations of an Android Enterprise profile into categories on the Add profile configuration page:

Category	Configurations
Security	Antivirus Protection, Authentication, Certificates, Factory Reset Protection, Out of Contact, Single Sign On, System Update Policy
Restrictions	Application Run Control, Browser, Browser Proxy, Feature Control, Firewall, Lockdown, Phone Calls, Web Filter
Connectivity	APN, SOTI VPN, VPN, WiFi
Email & Others	Bookmarks, Device Inactivity, Email: Exchange For Gmail, Managed Google Play, OEMConfig, Task Scheduler, Wallpaper
SOTI Apps	Settings Manager, SOTI Hub, SOTI Surf

Create the profile

1. Sign in to the SOTI MobiControl web console.
2. Navigate to Policies > Profiles.
3. Select New Profile.
4. Select Android Enterprise as the platform.
5. Enter a name for the profile (for example, Datalogic Device Settings).
6. Open the Configurations tab.

Add certificates

1. Select Add Configuration.
2. Under Security, select Certificates.
3. Select Add.
4. Select Browse and upload the certificate file.
5. Enter the certificate password, if the certificate has one.
6. Select OK.
7. Select Save.

Add a Wi-Fi network

1. Select Add Configuration.
2. Under Connectivity, select WiFi.
3. Select Add.
4. Enter the network SSID.
5. Select the Security Type.
6. Enter the password, or for an enterprise network, select the EAP Type and the certificates added above.
7. Select OK.
8. Select Save.

Add lockdown

1. Select Add Configuration.
2. Under Restrictions, select Lockdown.
3. Select Add to add the apps that the user can open.
4. Select each app.
5. Select OK.
6. Configure the menu layout and any other lockdown options.
7. Select Save.

Assign the profile

1. Select Save and Assign.
2. Select the device group to which the profile should be assigned.
3. Confirm the assignment.
4. Verify that the profile is installed on the devices.

Microsoft Intune

These steps are based on Microsoft's Wi-Fi settings for Android Enterprise devices, Types of certificates supported by Microsoft Intune, and Android Enterprise device restriction settings guides.

In Intune, each setting type is a separate configuration profile. Create the certificate profile first, so that it can be selected in the Wi-Fi profile.

Create the trusted certificate profile

1. Sign in to the Microsoft Intune admin center.
2. Select Devices.
3. Select Manage devices.
4. Select Configuration.
5. Select Create.
6. Select New policy.
7. Under Platform, select Android Enterprise.
8. Under Profile type, select Templates.
9. Under Fully Managed, Dedicated, and Corporate-Owned Work Profile, select Trusted certificate.
10. Select Create.
11. Enter a name for the profile (for example, Datalogic Root CA).
12. Select Next.
13. Select the folder icon and upload the root certificate (.cer) file.
14. Select Next.
15. Under Assignments, select Add groups.
16. Select the device groups that should receive the certificate.
17. Select Select.
18. Select Next.
19. Select Create.

Create the Wi-Fi profile

1. Select Create.
2. Select New policy.
3. Under Platform, select Android Enterprise.
4. Under Profile type, select Templates.
5. Under Fully Managed, Dedicated, and Corporate-Owned Work Profile, select Wi-Fi.
6. Select Create.
7. Enter a name for the profile (for example, Datalogic Wi-Fi).
8. Select Next.
9. Under Wi-Fi type, select Basic or Enterprise.
10. Enter the Network name and the SSID.
11. For a basic network, select the Wi-Fi type and enter the Pre-shared key. For an enterprise network, select the EAP type and select the trusted certificate profile created above under Root certificate for server validation.
12. Select Next.
13. Under Assignments, select Add groups.
14. Select the device groups that should receive the Wi-Fi network.
15. Select Select.
16. Select Next.
17. Select Create.

Create the kiosk mode profile

1. Select Create.
2. Select New policy.
3. Under Platform, select Android Enterprise.
4. Under Profile type, select Templates.
5. Under Fully Managed, Dedicated, and Corporate-Owned Work Profile, select Device restrictions.
6. Select Create.
7. Enter a name for the profile (for example, Datalogic Kiosk).
8. Select Next.
9. Expand Device experience.
10. Set Enrollment profile type to Dedicated device.
11. Set Kiosk mode to Single app or Multi app.
12. Select Add and select the apps that the user can open.
13. Configure any other restrictions required by your organization.
14. Select Next.
15. Under Assignments, select Add groups.
16. Select the device groups that should be locked down.
17. Select Select.
18. Select Next.
19. Select Create.

SureMDM

These steps are based on 42Gears' Configure Android Enterprise Profile guide.

Create the profile

1. Sign in to the SureMDM web console.
2. Navigate to Profiles.
3. Select the Android tab.
4. Select Add.

Add certificates

1. Select Certificate Policy.
2. Select Configure.
3. Select Add.
4. Select Browse and upload the certificate file.
5. Enter the certificate password, if the certificate has one.
6. Select Save.

Add a Wi-Fi network

1. Select Wi-Fi Configuration.
2. Select Configure.
3. Select Add.
4. Enter the network SSID.
5. Select the Security Type.
6. Enter the password, or for an enterprise network, select the EAP Method and the certificate added above.
7. Select Save.

Add lockdown

1. Select Application Policy.
2. Select Configure.
3. Enable Kiosk Mode.
4. Select Single App or Multi App.
5. Select Add and select the apps that the user can open.
6. Select Save.

Save and apply the profile

1. Enter a name for the profile (for example, Datalogic Device Settings).
2. Select Save to create the profile.
3. Return to the Home tab.
4. Select the target device or devices.
5. Select Apply.
6. Select the profile.
7. Select Apply to deploy the profile.
8. Verify that the profile has been applied to the devices.

Workspace ONEWorkspace ONE (formerly AirWatch)

These steps are based on Omnissa's Android Profiles for Custom DPC documentation.

Create the profile

1. Sign in to the Workspace ONE UEM console.
2. Select the Organization Group that manages your devices.
3. Navigate to Resources > Profiles & Baselines > Profiles.
4. Select Add.
5. Select Add Profile.
6. Select Android.
7. Enter a name for the profile (for example, Datalogic Device Settings).
8. In Smart Groups, select the Smart Groups that should receive the profile.

Add certificates

1. Select the Credentials payload.
2. Select Add.
3. Set Credential Source to Upload.
4. Select Upload and select the certificate file.
5. Enter the certificate password, if the certificate has one.

Add a Wi-Fi network

1. Select the Wi-Fi payload.
2. Select Add.
3. Enter the Service Set Identifier (SSID).
4. Select the Security Type.
5. Enter the password, or for an enterprise network, select the Protocols and the certificate added in the Credentials payload.

Add lockdown

1. Select the Launcher payload.
2. Select Configure.
3. Select Single App or Multi App.
4. Add the apps that the user can open.
5. Select Save.

Publish the profile

1. Select Save & Publish.
2. Review the assigned devices.
3. Select Publish.
4. Verify that the profile is installed on the devices.