Mobile Device Provisioning

When a user sets up a mail account on a new device via Exchange ActiveSync, the device is automatically placed in quarantine. To start receiving mail, you need to release the device from quarantine. You can do this using the Axidian Mobile Device Provisioning (MDP) module.

System requirements

To configure the Mobile Device Provisioning module:

Create and configure a service account for the interaction between MDP and Active Directory.
Install the module using the MSI package.
Register the module license in Management Console.
Perform the settings in Internet Information Services (IIS).
Edit the module configuration file.
Configure authentication via Identity Provider.
Configure the display of the tab in User Console.
If necessary, enable logging.

Create and configure a service account

The Mobile Device Provisioning module will access Active Directory through a service account in order to build the list of devices in quarantine. The search by the user's email address is performed on behalf of this account.

To configure the service account:

In Active Directory, create a service account.
Open the Exchange Control Panel (ECP).
In the Permissions section, on the Admin Roles tab, click to create a new role group.
In the window that opens, specify the following settings:

In the Name field, enter the name of the group.
In the Roles section, add:
- Mail Recipients — the role for receiving device data.
- Mailbox Search — the role for receiving the email address. Without this role, the service account will only be able to receive its own email address.
- Organization Client Access — the role for granting access to a device and for blocking.
In the Members section, add the service account created earlier.

Click Save.

Install the module

Run IndeedAM.MobileDevProv-v8.2.2.x64.ru-ru.msi, located at the path indeed AM <version number>/Indeed AM Mobile Device Provisioning/<version number>.

When the installation is complete, you will be prompted to generate a new IDP certificate. The certificate is required for authentication via Identity Provider.

Settings in Internet Information Services

After installation, perform the following settings in Internet Information Services:

Add the service account to the application pool identity.
Change the version of the CLR runtime.

Add a service account

To add a service account to the application pool, do the following:

Open IIS Manager.
In the left Connections menu, expand the node corresponding to your Axidian Access server.
Select Application Pools.
In the list, select IndeedAM.MDP. In the menu that opens on the right, select Edit Application Pool→Advanced Settings.
In the Advanced Settings window that opens, in the Process Model section, select Identity and click .
In the Application Pool Identity window that opens, select Custom account and enter the user name and password for the created Active Directory service account.
Click OK. The Application Pool Identity window will close.
In the Advanced Settings window, in the Process Model section, select Load User Profile and select the value True in the drop-down list.
Save the changes.

Change the CLR runtime version

To change the CLR runtime version:

Open IIS Manager.
In the left Connections menu, expand the node corresponding to your Axidian Access server.
Select Application Pools.
In the list, select IndeedAM.MDP. In the menu that opens on the right, select Edit Application Pool→Basic Settings.
In the Edit Application Pool window that opens, in the .NET CLR runtime version drop-down list, select No Managed Code and click OK.

Configure the module configuration

In the MDP configuration file C:\inetpub\wwwroot\am\mdp\app-settings.json, make the changes:

In the Exchange section, in the ServerUrl parameter, specify the connection address to the remote Exchange PowerShell server in the format https://full_dns_server_name/Powershell.
Example
```
"Exchange": {
  "ServerUrl": "https://exchange.indeed-test.com/Powershell"
```
Verification in the Exchange Control Panel (ECP)
In the Exchange Control Panel, open the Servers section and go to the Virtual Directories tab. In the properties of PowerShell (Default Web Site), make sure that the address specified in the configuration file matches the internal URL.
In the Server section, in the Url parameter, specify the Log Server address in the format https://full_dns_server_name/ls/api/.
Example
```
"Server": {
    "Url": "https://amcore.indeed-test.com/ls/api/"
```

In the SAML section, configure the connection to Identity Provider:

In the LocalServiceProviderConfiguration section, in the Thumbprint parameter, specify the thumbprint of the MDP certificate.
To get the certificate thumbprint using a PowerShell request, use the command:
```
Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=mdpsp"}
```
In the PartnerIdentityProviderConfigurations section:
- In the SingleSignOnServiceUrl parameter, specify the Single Sign-On Service address in the format https://full_dns_server_name/am/idp/Account/SsoService.
- In SingleLogoutServiceUrl, specify the Single Logout Service address in the format https:// full_dns_server_name/am/idp/Account/SloService.
- In Thumbprint, specify the thumbprint of the Identity Provider certificate.
To get the certificate thumbprint using a PowerShell request, use the command:
```
Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=idp"}
```

Example

//highlight-grey-next-line
"SAML": {
  "$schema": "https://www.componentspace.com/schemas/saml-config-schema-v1.0.json",
  "Configurations": [
    {
      "LocalServiceProviderConfiguration": {
        "AssertionConsumerServiceUrl": "Account/AssertionConsumerService",
        "LocalCertificates": [
          {
            "Thumbprint": "3FD40F59795C9F5977E33E18FCE2D5BB27FDC65C"
          }
        ]
      },
      "PartnerIdentityProviderConfigurations": [
        {
          "Name": "urn:indeedid:saml_idp",
          //highlight-grey-start
          "SingleSignOnServiceUrl": "https://amcore.indeed-test.com/am/idp/Account/SsoService",
          "SingleLogoutServiceUrl": "https://amcore.indeed-test.com/am/idp/Account/SLOService",
          //highlight-grey-end
          "PartnerCertificates": [
            {
              //highlight-grey-next-line
              "Thumbprint": "D520DC2E6BEDB1400526842CA88485FFB2F8D757"
            }

Configure authentication via Identity Provider

For Axidian Mobile Device Provisioning, two-factor authentication via Identity Provider is provided. If the user has authenticated in User Console, they are automatically authenticated in the module.

How to install and configure Identity Provider

To configure authentication in MDP:

Open the Identity Provider configuration file C:\inetpub\wwwroot\am\idp\app-settings.json.

Make the following changes:

In the CustomAttributes section, in the ServiceProvider parameter, specify the urn of the MDP service and the user attributes from AD, for example:

 "CustomAttributes": [
   {
     //highlight-grey-next-line
     "ServiceProvider": "urn:indeedid:mobiledeviceprovisioning",
     "Attributes": [
       {
         //highlight-grey-start
         "Name": "user_name",
         "UserNameFormat": "PrincipalName"
         //highlight-grey-end
       }

In the SAML section, add the block to the PartnerServiceProviderConfigurations section:

      {
         "Name": "urn:indeedid:mobiledeviceprovisioning",
         //highlight-grey-next-line
         "SingleLogoutServiceUrl": "https://full_dns_server_name/am/mdp/Account/SLOService",
         "PartnerCertificates": [
           {
             //highlight-grey-next-line
             "Thumbprint": "3FD40F59795C9F5977E33E18FCE2D5BB27FDC65C"
           }
         ]
      },

where:

In the SingleSignOnServiceUrl parameter, specify the MDP module address in the format https://full_dns_server_name/am/mdp/Account/SLOService.
In the PartnerCertificates parameter, specify the thumbprint of the MDP certificate generated during the module installation.
To get the certificate thumbprint using a PowerShell request, use the command:
```
Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=mdpsp"}
```

Example

//highlight-grey-next-line
"SAML": {
  "$schema": "https://www.componentspace.com/schemas/saml-config-schema-v1.0.json",
  "Configurations": [
    {
      "LocalIdentityProviderConfiguration": {
        "Name": "urn:indeedid:saml_idp",
        "SingleSignOnServiceUrl": "https://amcore.indeed-test.com/am/idp/Account/SsoService",
        "LocalCertificates": [
          {
            "Thumbprint": "D520DC2E6BEDB1400526842CA88485FFB2F8D757"
          }
        ]
      },
      "PartnerServiceProviderConfigurations": [
        {
          "Name": "urn:indeedid:selfservice",
          "SingleLogoutServiceUrl": "https://amcore.indeed-test.com/am/uc/Account/SLOService",
          "PartnerCertificates": [
            {
              "Thumbprint": "DE67FAABC02FC39BB640B99108918481A3C280EC"
            }
          ]
        },
        {
          "Name": "urn:indeedid:emc",
          "SingleLogoutServiceUrl": "https://amcore.indeed-test.com/am/mc/Account/SLOService",
          "PartnerCertificates": [
            {
              "Thumbprint": "17BE639E90FA69A5C0F9241E5B0BE6A826604D9C"
            }
          ]
      },
    //highlight-grey-start
         {
          "Name": "urn:indeedid:mobiledeviceprovisioning",
          "SingleLogoutServiceUrl": "https://amcore.indeed-test.com/am/mdp/Account/SLOService",
          "PartnerCertificates": [
            {
              "Thumbprint": "3FD40F59795C9F5977E33E18FCE2D5BB27FDC65C"
            }
          ]
         },
    //highlight-grey-end

Configure the display of the module in User Console

The module is an additional tab in User Console — Exchange Mobile Devices, in which the user can release a device from quarantine on their own.

By default, the Axidian Mobile Device Provisioning module is not displayed as a separate tab in User Console.

To configure the display of the module:

Open the User Console configuration file C:\inetpub\wwwroot\am\uc\Web.config.
Make the following changes:
- Add the following line to the configSections section, if it is not there:
```
section name="amMobileDeviceProvisioning" type="IndeedID.Web.SelfService.Settings.MobileDeviceProvisioningSettings"
```
- Find and change the line:
```
amMobileDeviceProvisioning isEnabled="false" url="MOBILE_DEVICE_PROVISIONING_URL/device/embed"
```
  - In the isEnabled parameter, specify the value true to configure the display of the tab in User Console.
  - In the url parameter, specify the address of the server with the installed Mobile Device Provisioning module in the format https://full_dns_server_name/am/mdp/device/embed.

Example

<configuration>
<configSections>
  <section name="amAuthServer" type="IndeedID.Web.Shared.Utils.ConfigReader.AuthServerSettings, IndeedID.Web.Shared, Version=1.0.0.0, Culture=neutral" />
  <section name="amCulture" type="IndeedID.Web.Shared.Utils.ConfigReader.CultureHandler, IndeedID.Web.Shared, Version=1.0.0.0, Culture=neutral" />
  <section name="amAuthentication" type="IndeedID.Web.Shared.Utils.ConfigReader.AuthConfigReader" />
  <section name="amProviderImages" type="IndeedID.Web.Shared.Utils.ConfigReader.ProviderImagesHandler, IndeedID.Web.Shared, Version=1.0.0.0, Culture=neutral" />
  <section name="amApplicationSettings" type="IndeedID.Web.Shared.Utils.ConfigReader.ApplicationSettingsHandler" />
//highlight-grey-next-line
    <section name="amMobileDeviceProvisioning" type="IndeedID.Web.SelfService.Settings.MobileDeviceProvisioningSettings" />
</configSections>
<amAuthServer Url="https://amcore.company.com/am/core/" />
<amCulture isEnabled="true" />
<amProviderImages configSource="Config\providerImages.config" />
<amAuthentication mode="Saml" loginUrl="https://amcore.company.com/am/idp/" identityProviderCertificateThumbprint="D520DC2E6BEDB1400526842CA88485FFB2F8D757" serviceProviderCertificateThumbprint="DE67FAABC02FC39BB640B99108918481A3C280EC" enableLogout="true" />
<amApplicationSettings configSource="Config\applicationSettings.config" />
//highlight-grey-next-line
<amMobileDeviceProvisioning isEnabled="true" url="https://amcore.indeed-test.com/am/mdp/device/embed" />
<appSettings>

Important!

Identity Provider is used for authentication in the MDP module. If User Console and Identity Provider are on different machines and have different domain names, add the Content-Security-Policy parameter to the customHeaders section in the Identity Provider configuration file Web.config.

Example
<customHeaders>
<add name="Content-Security-Policy" value="frame-ancestors 'self' https://*.domain.local" />
</customHeaders>

Configure logging

To learn how to configure log collection for the MDP module, read the Collecting logs of server components section.

The following module events are displayed in the Axidian Access event log:

The user successfully released the mobile device from quarantine.
Failed to release the mobile device from quarantine
The user blocked the mobile device
Failed to block the mobile device

For more details, see the Events section.

Create and configure a service account​

Install the module​

Settings in Internet Information Services​

Add a service account​

Change the CLR runtime version​

Configure the module configuration​

Configure authentication via Identity Provider​

Configure the display of the module in User Console​

Configure logging​

Create and configure a service account

Install the module

Settings in Internet Information Services

Add a service account

Change the CLR runtime version

Configure the module configuration

Configure authentication via Identity Provider

Configure the display of the module in User Console

Configure logging