Mobile Device Management Implementation Plan
This document provides a detailed step-by-step plan for setting up an device management service placed in a typical company single-server DMZ.
It is divided into three main sections, each describing necessary phases of an Device Management implementation
The result of completing all the steps in this plan should be a fully operational system with an enrolled test device, ready for device management and distribution of profiles and apps.
Preparation
| # | Action | Comments / Description |
|---|---|---|
| 1 | It is important that certain ports are opened between the DMZ and LAN, and between the DMZ and the internet, for the MDM services to be able to communicate with devices outside of the company infrastructure. Request that your network manager opens the required ports for traffic from the DMZ server towards the CapaInstaller servers that are assigned to host the Backend service and the Frontend service. | The service default port numbers are referenced in the CapaInstaller Network Port Reference The ports numbers are customizable. |
| 2 | Assign a physical or virtual Windows server in the DMZ to host the MDM service (from now on referred to as the DMZ server). Before MDM deployment, create a DNS Alias record to the server hosting your MDM service. This way the alias can easily be redirected to another host later, if the MDM service is moved to a new server. | |
| 3 | Request that your network manager creates a firewall rule or opens up traffic from the internet to the DMZ server. This is often done by using a subdomain (http/https: mdm.company.com > DMZ server). | As a minimum these two ports must be opened: 443 (SSL) and 5024. The service default port numbers are referenced in the CapaInstaller Network Port Reference |
For a quick overview of the required open network ports click below
Furthermore, there are some platform specific network preparations needed as documented below...
Network Preparation for Managing Apple Devices
Network Preparation for Managing Android Devices
Network Preparation for Managing Windows Phone Devices
Deployment
| # | Action | Comments / Description |
|---|---|---|
| 1 | Before you install the MDM service, make sure that the DMZ server has .NET 4.0 installed. | If .NET 4.0 is not installed on the DMZ server, make sure you install it now. |
| 2 | On a newly deployed CapaInstaller system with no services, make sure that the internal server has a Backend service and a Frontend service deployed. If not, deploy them on the internal server before deploying the MDM and SCEP services | How to Deploy Backend Service How to Deploy Frontend Service |
Check that the two ports for the Frontend and Backend services are open through the DMZ. Open a browser on the DMZ server and verify that you are able to open the following URLs: Frontend service: http://capaserver.company.com:[frontend public port]/cifrontend. If there is no DNS lookup in the DMZ, you must write something like http://[frontend server IP]:[frontend public port]/cifrontend. Backend service: http://capaserver.company.com:[backend public port]/cibackend. If there is no DNS lookup in the DMZ, you must write something like http://[backend server IP]:[backend public port]/cibackend. | The response from the services will be some internal json. The important thing is that the response is different from HTTP status code 404 (Not found) or HTTP status code 500 (Internal server error). If this fails, check the following:
| |
| 3 | For DMZ deployment, open System Administration in the CapaInstaller console and offline deploy the SCEP service and the MDM service. The target machine is the DMZ server. In non-DMZ setups (not recommended) simply deploy the services normally from System Administration directly to the internal server. | Offline deployment is described in the deployment guide for the MDM and the SCEP services. It is assumed that the MDM and SCEP services are placed on the same server. |
| 4 | When you have created both services as offline-installations in CapaInstaller, you must to install the services on the DMZ Server. Log in to the DMZ server and open the following URL: Back-end service: http://capaserver.company.com:[backend public port]/cibackend/install . If there is no DNS lookup in the DMZ, you must write something like http://[backend server IP]:[backend public port]/cibackend/install. You should now see a web page that lets you install the MDM and SCEP services, | If you cannot open the web page, check the following:
If you cannot see any MDM or SCEP service to install:
|
| 5 | Go back to the web page and select the MDM service. It will now download an executable file. | The browser may ask you to allow the .exe file to be downloaded; you can safely allow this. |
| 6 | When download has completed, run the executable with administrative privileges. The MDM service will now be installed, and it should automatically start after installation. | If you cannot install the MDM service, check the following:
|
Apple-Specific Deployment Tasks
Enrollment
| # | Server-Side Actions | Comments / Description |
|---|---|---|
| 1 | Now the services are installed successfully. Verify that both services get a green check mark in System Administration in the CapaInstaller console. | If a service does not have a green check mark, try to restart the service. |
| 2 | Check that the services are running. Log in to the DMZ server and open the following URLs:
| If running, the SCEP service will display a dummy page stating that the SCEP server is running. If running, the MDM service will show an error page stating that the used device cannot be enrolled into this service. Do not worry about the error message; the fact that you can see it indicates that the MDM service is running. If running, the MDM service will display a dummy page stating that the CapaInstaller OMA DM server is running. |
| 3 | Check that the services can be reached from the internet. Log in to a pc on the internet—or use a 3G/4G phone or tablet (the important thing is that the device must access the services from the internet and not the local network)—and open the following URLs for your implemented platforms:
| If you cannot access the services, check the following:
If running, the MDM service will show an error page stating that the used device cannot be enrolled into this service. Do not worry about the error message; the fact that you can see it indicates that the MDM service is running. If running, the MDM service will display a dummy page stating that the CapaInstaller OMA DM server is running. |
Now the server-side preparations are complete, and the system is ready for enrollment.
Before enrolling the first device, check device compatibility and readiness.
| # | Client-Side Checks | |
|---|---|---|
1 |
Apple-Specific EnrollmentAndroid-Specific EnrollmentWindows-Phone-Specific Enrollment | |
| 2 | Try to enroll a device for every platform you plan to support. If devices seem not to appear in the console post-enrollment, remember to check the "Quarantined Units" view for devices waiting for an approval to enroll. Device enrollment | If enrollment fails, check the services' log files. |
Your system is now ready, and you have your first device enrolled and ready for management and deployment.
Best Practice Notes
- Complete your Apple account registration for generating the Apple Push certificate well in advance of implementation because it may take some time before the registration procedure is complete.
- Because the MDM service is located on a specific server that might be changed or moved, make a DNS routing from an alias so all devices are enrolled at a simple URL like https://mdm.example.com/ which can be pointed to the MDM URL.
- Change the Apple certificate in good time before it expires, otherwise all Apple devices must be re-enrolled.
- The enrollment page (MDM service configuration) should preferably use port 443. This is because browsers automatically assume port 443 when they access a URL that begins with https. If the service uses another port, you can either add the port to the enrollment URL (for example https://mdm.example.com:8443/cimdm ) or use a DNS alias or a reverse http proxy that routes from port 443 to the configured port.
- The login URL, for example https://mdm.example.com/, must be protected with a valid SSL certificate.
- Just like when you deploy software to pcs, we recommend that you test new MDM profiles and MDM devices in a "development" Configuration Management Point before you promote the profiles or devices to the "production" Configuration Management Point. By default you will probably want all enrolled devices to be in the "production" Configuration Management Point. In order to make a device enroll in the "development" Configuration Management Point, you must either create a new user that uses the "development" Configuration Management Point or move an existing user to the "development" Configuration Management Point before enrollment.
Read more:
- Getting started with MDM app deployment
- Creating MDM profiles with the Profile Editor
- CapaInstaller Network Port Reference