App restrictions descriptions for Ivanti Email+ (Android Enterprise)

Required. Defines the email address for the email account.

Ivanti EPMM

Typically, enter $EMAIL$.

You can also enter combinations of these variables, depending on your ActiveSync server requirements:

$USERID$,

$USER_CUSTOM1$,

$USER_CUSTOM2$,

$USER_CUSTOM3$,

$USER_CUSTOM4$

Ivanti Neurons for MDM

Typically, enter ${userEmailAddress}.

Required. Defines the username for the email account.

Ivanti EPMM

Typically, use $USERID$. If your ActiveSync server requires a domain, use
<domain name>\$USERID$.
Example: mydomain\$USERID$.

Depending on your ActiveSync server requirements, you can also use combinations of these variables:

$EMAIL$,

$USER_CUSTOM1$,

$USER_CUSTOM2$,

$USER_CUSTOM3$,

$USER_CUSTOM4$.

Ivanti Neurons for MDM

Typically, use ${userEmailAddressLocalPart}. If your ActiveSync server requires a domain, use
<domain name>\${userEmailAddressLocalPart}.
Example: mydomain\${userEmailAddressLocalPart}.

Depending on your ActiveSync server requirements, you can use:

${userEmailAddress}

Required.

Select to allow the app to automatically accepts untrusted certificates. Typically, you select this option only when working in a test environment.

Default: Not selected.

Configure for certificate-based authentication to the ActiveSync server or to Standalone Sentry.

Ivanti EPMM

The certificate enrollment setting name is the name you gave to the certificate enrollment setting, which is configured in Configurations > Add New > Certificates or Certificate Enrollment.

Ivanti Neurons for MDM

The certificate setting is configured in Configurations > Add > Certificate or Identity Certificate.

For certificate-based authentication, the Authorization Mode restriction must also be set to Certificate-based Authentication.

Specifies the certificate to use for encrypting S/MIME emails.

Ivanti EPMM

The certificate enrollment setting name is the name you gave to the certificate enrollment setting, which is configured in Configurations > Add New > Certificates or Certificate Enrollment.

Ivanti Neurons for MDM

The certificate setting is configured in Configurations > Add > Certificate or Identity Certificate.

Specifies the safe domains.

Example: mycompany.com,mycompany.net,internal.mycompany.com

Ensure that there are no empty spaces before and after the comma.

Email addresses not in the safe domain list are displayed in red color in Email+. You may want to use this key-value pair if your company has multiple domains and you want to identify the company domains as opposed to domains that are not company domains.

To disable this feature, you can set the value to "*"

Default if the restriction is not configured: Only the domain of the user's email address is considered safe. All other domains will be highlighted in red.

Select to give device users the option to export contacts as an attachment in an email.

Default: Check box is selected.

Select to allow device users to automatically see images in an email. The setting turns on the Show Pictures option on the device.

Device users can override the configuration in the UEM by turning the Show Pictures option on or off on the device.

If you change the value, Email+ does not change the Show Pictures option until Email+ does a full synchronization. A full synchronization occurs only when you change certain fundamental values like Email address, or when the device user uninstalls and reinstalls Email+.

Default: Check box is not selected. The Show Pictures option is turned off.

The minimum number of characters for Email+ to use for automatic Global Address List (GAL) lookup in Mail and Contacts.

When entering a name, after the specified number of characters, Email+ starts searching the GAL and presents the matches that it finds.

On your Exchange server, set the minimum number of characters for GAL search to the same value you set for this key. If you do not, GAL search will not work properly in Email+.

Default: 4.

Specifies the maximum limit for email message body size that can be received by the Email+ app.

Default: 4 MB

Specifies the maximum number of days for which emails are downloaded:

0: all emails.

1: emails received over the last one day.

2: emails received over the last three days.

3: emails received over the last seven days.

4: emails received over the last two weeks.

5: emails received over the last one month.

Default: 0.

block_external_gal: Disables global address lookup (GAL) of Email+ contacts in the native Contacts app. Configure the value only if the Google account configured for Android Enterprise supports GAL.

skip_empty_links: Some exchange servers block custom links and the hyperlinks are stripped from the email body. For example, the url mibrowser:// that is used to launch Web@Work and may not become click-able when sent via email. The work around for this problem is, Email+ has additional capability to detect such emails and automatically fetch their body as MIME data that is unmodified by exchange. We recommend that administrators evaluate this capability in their environment by adding "skip_empty_links" into the

"enabled_features" KVP. Fetching MIME data may not work in all configurations.

show_formatting: Enables the “Always show formatting” option if it was not previously changed manually.

multiple_accounts: Enables secondary email account on the same device.

eas_16: Enables ActiveSync 16 specific folder synchronization features in Email+. When Email+ receives "eas_16" the first time, Folder resync is expected.

When "eas_16" protocol is added to Optional Features restrictions:

• if the highest ActiveSync version for the server is 16.1 or higher, enable Email+ to sync via EAS 16.1 version.
• if the highest ActiveSync version for the server is 16.0, enable Email+ to sync via EAS 16.0 version
• if the highest ActiveSync version for the server is lower than 16.0, then it works as per the current settings.

allow_shortcuts: Enables the user to create shortcuts for launch Calendar, Contact, Notes, and Tasks.

calendar_delegation: Enables the Add Delegated Calendar option.

entrust_certificates: Enable support for entrust certificate for Android Enterprise cloud. The Email+ app now fetches these certificates from the keystore. This is applicable for Android Enterprise device registration mode such as Profile Owner, Device Owner, and EPO with Microsoft Office 365 using Modern auth. The Email+ Android Enterprise apps uses the certificates is as follows:

• Authorization Cert: This certificate is used to login to the Email+ app.
• Signing /Encryption: This certificate is used for SMIME functionality.

smime_suppress_certificate_email_check: Automatic certificate verification using email address is suppressed and the user can manually add a certificate using the Keystore and GALoptions.

delegated_shared_mailbox: delegated_shared_mailbox: Enables the delegated mailbox option. When this value is removed:

• All added Delegated mailbox accounts are removed from Email and Setting's screen.

• "Add a Mailbox" button is removed under Email screen and Setting's screen.

• If only Primary account is added then the arrow to expand and collapse to show different mailbox's and Add a Mailbox label are also removed.

• If Secondary account is available then arrow to expand and collapse to show different mailbox's will be available but Add a Mailbox label is not available.

The value is represented in seconds.

The value overwrites the default connection timeout value for all requests. You may want to configure the key-value pair to manage slow connections with the ActiveSync server or for syncing large folders and emails.

If the value is 0, negative, or non-integer, the default value is used.

Default: 90 seconds.

Select to alert Email+ users if the recipients in an email or calendar invite include addresses that are not in a safe domain.

If the restriction is configured, but safe domains (Email safe domains) are not configured, only the domain of the user's email address is considered safe. Device users have the option to either proceed or cancel sending the email.

Default: Not selected. An alert is not displayed for addresses not in a safe domain.

Sets the default display order for contact names in search results. Device users can change the display order in Email+ in Settings > Contacts.

first_last: Contact names in search results are displayed with first name followed by the last name.

last_first: Contact names in search results are displayed with last name followed by the first name.

Default: first_last.

This is enabled to specify Microsoft Office 365 authority url.

Enables the email classification feature. If present, it specifies the list of classification values to be used and all the supported permutations.

See Document classification capabilitiessection for more information.

Enable this option to allow import or add attachments from personal profile applications. For example, importing certificates from storage or attaching images from photo gallery.

Disables email treading for email messages.

false: "Email Threading” is turned "ON".

To support EWS authentication when Exchange host restriction contains NOT the fully qualified domain name (FDQN) of the EWS server, Exchange host for EWS restriction should have a FDQN as the value for the EWS server.

If not configured, the value of Exchange host restriction is used as the EWS server.

Configures encryption algorithm.

The restriction is empty by default. if there is no value of invalid set, then 3des is used.