iOS MDM policies

Crazed'n'Dazed picture Crazed'n'Dazed · Mar 11, 2013 · Viewed 7.4k times · Source

I need to prepare a presentation on iOS Mobile Device Management. I have been asked to include the policies that are implemented and choose one of the and describe it in detail. The problem is, I don't know what are the different policies that exist. Please help me out.

Answer

Victor Ronin picture Victor Ronin · Mar 11, 2013

Here are the link for everything you need to know about MDM and around MDM.

Over-the-Air profile delivery concept

http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/OTASecurity/OTASecurity.html

MDM

(This one requires access to Apple Enterprise Developer Program) http://adcdownload.apple.com//Documents/mobile_device_management_protocol/mobile_device_management_protocol.pdf

Reverse engineered MDM protocol:

http://media.blackhat.com/bh-us-11/Schuetz/BH_US_11_Schuetz_InsideAppleMDM_WP.pdf

Enterprise Deployment guide

http://manuals.info.apple.com/en_US/Enterprise_Deployment_guide.pdf

Configuration profiles guide

http://developer.apple.com/library/ios/#featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html

Update 1

Here is exameple how allow game center works. Let say you have a device enrolled in MDM.

  • At some moment MDM server decides that you (your device) should be diasslowed to run game center (as example it's your enterprise policy).
  • MDM server generate a Install Configuration Profile command and put it in the queue of pending commands for your device.
  • MDM server sends push notification to your device
  • Your device receives push notification and contacts back to MDM Server
  • Your device requests for any outstanding commands
  • Your device receive a command Install Configuration Profile. As part of this command, you it gets a profile which contains Restriction payload.
  • This restriction payload will have a key allowGameCenter with value false
  • Your Device will save this configuration profile
  • A user will be prohibited from running Game center thereafter.