Activating the GravityZone MTD
The onboarding process for the GravityZone MTD on all devices can be completed either by using an activation link or by logging in with a domain name.
Note
Android devices require the Location - While using the app or Location - Allow all the time permission to mitigate certain network threats, such as Unsecured WiFi. The permissions option's verbiage depends on your device.
On-Boarding with Activation Links and QR Codes
There are two ways in which you can activate the GravityZone MTD.
The activation link - a URL that initiates the activation process for one or more devices.
The QR code - an image representation of an activation URL, serving an identical purpose, that can also initiate the activation of one or more devices.
The availability of URL activation options is determined by the enabling of anonymous user access. Enabling anonymous user functionality prevents the system from generating activation URLs for individual end-users. The table presents details on the features available for different settings for anonymous users.
Anonymous Users Enabled | Activation URL Functionality |
|---|---|
Yes |
|
No |
|
Users can receive the activation link and QR code from a local device group. The hyperlink triggers the activation of the GravityZone MTD on a specified quantity of devices. The process facilitates the dissemination of the link and QR code to individual users.
On-Boarding with Domain Name
Customers have the option to input their domain name, such as "example.com," when starting Mobile Security. Customers with integration to a supported identity provider can utilize domain-based logins. If the GravityZone MTD has knowledge of the domain name, activation will be initiated using the single sign-on activation flow.
Auto-Activation of Any MDM for a Local Device Group
The Mobile Device Management (MDM) system can configure the MTD configuration key to automatically activate Mobile Threat Defense on iOS and Android platforms.
To access the Local Device Groups tab, navigate to the Devices page in the v4 Mobile Security console. An activation link can be generated to enable Mobile Security functionality.
This feature enables the automatic activation of the GravityZone MTD with MDM vendors, whether they are directly integrated with the Mobile Security console or not.
This activation method can be used with any Mobile Device Management (MDM) system that supports using a device identifier as a variable. Some Mobile Device Management (MDM) solutions provide support for additional variables and tracking IDs that can be used.
Use the given set of unique and optional configuration keys and values to enable the automated activation procedure of an iOS or Android device.
Important
These configuration keys are not additional to other MDM configuration keys and are used instead of other configuration options. If you use a different configuration option the activation_link key must be blank.
Configuration Key | Value type | Configuration Value | Additional notes |
|---|---|---|---|
activation_link | String | Retrieve from the Mobile Security console | Copy the value from the Activation Link field on the Mobile Security console Devices page under the Local Device Groups tab for a specific group. |
tracking_id_1 | String | Use the desired identifier | This is a needed tracking identifier. You can use an MDM device identifier to track the device, or any identifier you choose. Note: If you do not use some tracking identifier value, you cannot track the device in Mobile Security console. |
tracking_id_2 | String | This is an additional tracking identifier. |
Activations for Integrated MDMs
To access the Manage page, follow these steps:
Click on the Integrations tab.
Look for the Manage page within the tab.
On the Manage page, you will find activation URLs for customers.
Additionally, you can choose to regenerate and copy the activation link for devices that are being activated with an MDM.
The activation link is used to replace the MDM device identifier with a variable. This enables the device to connect with the corresponding Mobile Security console. The activation link has a default expiration period of one year from its generation. The user has the option to modify the default setting or set it to zero for indefinite expiration. The webpage displays the expiration date and time.
A full MDM activation link is provided and can now be used to activate integrated MDMs.
https://{{subdomain-portion}}-device-api.ms.gravityzone.bitdefender.com/activation?stoken=[token]&redirect_uri=bitdefenderbitdefender.com/activation?stoken={{token}}&mdm_id={{MDM Device Identifier}} MDM Device Identifier Variables
The device identifier variable, which is linked to the device, can be utilized in certain MDM email notifications where it is set. To manually use the link copied from the Mobile Security console, the user needs to replace the variable with the device identifier. After substituting the device ID value, the activation link becomes valid. The table presents the required MDM device identifier variable for various MDM systems.
MDM System | MDM Device Identifier Variable |
|---|---|
VMWare Workspace ONE UEM MDM | {DeviceSerialNumber} (used on VMWare Workspace ONE UEM site) {DeviceUid} (used in Mobile Security console) Note: The VMWare Workspace ONE UEM MDM link includes the device serial number when using the link on the VMWare Workspace ONE UEM site. The VMWare Workspace ONE UEM site has a UDID value but does not support this value as a variable in their templates. The emails that come from Mobile Security console use the device UDID and can be used by the Mobile Security console administrator. |
Business Concierge Device Management | n/a NoteFor Business Concierge, the device identifier is communicated to the device automatically and an auto-activation occurs, so no device identifier is needed. |
BlackBerry’s UEM MDM | %IOSUDIdentifier% |
Citrix MDM | $device.id |
Microsoft Intune Manager MDM | {{AzureADDeviceId}} |
MobileIron MDM | $DEVICE_UUID$ (for Core) ${deviceGUID} (for Cloud) |
IBM MaaS360 | %csn% (for iOS) %deviceid% (for Android) |
SOTI MobiControl | %DeviceIdentifier% |
Note
Blackberry Dynamics is not listed as it does not use activation link enrollment. The Blackberry UEM %IOSUDIdentifier% value can be used for Android.
If there is an issue, then try for Android the IMEI value ‘%DeviceIMEI%’ (Blackberry UEM does not yet support a specific UDID value for Android).
MDM Sample Activation Links
This table gives some sample MDM activation URLs for various MDMs with the variables. It shows the activation URL including the MDM Device Identifier variable already appended.
MDM System | Full activation |
|---|---|
VMWare Workspace ONE UEM MDM | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=4a4nM9uA&redirect_uri=bitdefender&mdm_id=%7bDeviceUid%7d |
Business Concierge Device Management | Note: For Business Concierge, the device identifier is communicated to the device automatically and an auto-activation occurs. No MDM activation link is needed. |
BlackBerry’s UEM | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=Trjekkse&redirect_uri=bitdefender&mdm_id=%IOSUDI dentifier% |
Citrix MDM | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=wG4aTrMn&redirect_uri=bitdefender&mdm_id=$devi ce.id |
Microsoft Intune Manager MDM | n/a |
MobileIron MDM | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=n5GeZLxf&redirect_uri=bitdefender&mdm_id=${devic ePK} |
Mobilelron Core | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=ZGoC5k34&redirect_uri=bitdefender&mdm_id=$DEVIC E_UUID$ SOTI |
SOTI MobiControl | https://gz1-device-api.ms.gravityzone.bitdefender.com/activation?stoken=d5seZXxf&redirect_uri=bitdefender&mdm_id=%Device Identifier% |
EULA Display Options
MDM deployments can have the End User License Agreement (EULA) on initial activation suppressed by using the GravityZone MTD configuration addition below. If this display_eula variable is missing, then the behavior defaults to yes. This then displays the EULA on Mobile Security activation.
Variable | Value |
|---|---|
display_eula | no |
Regenerating MDM Activation Links
This figure shows the MDM tab for MobileIron Cloud on the Mobile Security console Manage page as an example where the administrator can reset the expiry and regenerate a new activation link.
These steps describe an example process to manage devices:
Add the desired MDM with the selected Mobile Security console groups.
Copy the activation link URL for managed devices.
Use the activation link URL in these ways:
Substitute the variable with a value having the actual device identifier value and send it directly to a user for activation. Refer to the table above with the MDM Device Identifier variables.
Keep the variable itself (as in the examples in the above table) and use the activation link URL, for instance in the MDM welcome email on device enrollment. In this usage, the variable is evaluated by the MDM in the email that is sent out.
Click Regenerate Link to receive the Activation Link URL. The administrator sends the activation link by email, text, or any notification to users along with instructions to accept the GravityZone MTD being pushed to them.
MDM Validations
These validation checks exist for MDM integrations:
Groups cannot overlap from one MDM configuration to another. If you select a group that is already defined in another MDM configuration with the same credentials, you get an error notifying you of the overlap.
You can be notified of this overlap of groups from one MDM configuration to another, for instance, when updating a password, because this is new validation.
If you find overlapping groups, you need to remove the overlapping group from one of the MDM configuration instances. You may need to modify a separate MDM integration instance, remove the group there, and then complete your original MDM configuration modification.
Zero-Touch Activation for iOS and Android
This feature allows an administrator to activate the GravityZone MTD protection on managed devices without the end-user being required to click on the installed application.
In the list below you will find described the items set up for zero-touch activation and threat reporting:
The MDM has a group and a VPN Profile for the devices.
The device is registered with the MDM.
The MTD is pushed to the device.
The VPN Profile is initially pushed to the device.
The Mobile Security console has the MDM defined as an integration.
The Mobile Security console has the MDM Action and Mitigation Action set for the “App Pending Activation” threat.