Actions
| Action | Description | Values |
| applylabel | Applies a label to the device. | Example: Action=applylabel:corporateowned |
| removelabel | Removes a label from the device. | Example: Action=removelabel:sales |
| syslog | Sends details for a device that matches in a syslog message.Note: A syslog message can be sent with any other action by setting syslogsend=yes. | Example: Action=syslog |
| report | Send details for a device that matches to a CSV report.Note: A report can be created with any other action by setting reportsend=yes. | Example: Action=report |
| *reprovision*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | Reprovisions matching devices. This is the equivalent of choosing More Actions->Reprovision Device in the All Smartphones/Devices screen of the VSP.Reprovisioning for active iOS devices is supported by the VSP. Reprovisioning for active Android devices is not valid and can only be used with Pending Android devices. | Example:Action=reprovision |
| retire | Retires the device from MDM control and performs a selective wipe. Utilizes the INI key ActionReason when sending wipe command to the VSP. | Example: Action=retire |
| wipe | Performs a full device wipe to factory defaults. Utilizes the INI key ActionReason when sending wipe command to the VSP. | Example: Action=wipe |
| activesync | Blocks or reinstates ActiveSync access via the Ivanti Standalone Sentry. An ActiveSync wipe command can also be sent to the device.Note: When using the actions activesync:reinstate or activesync:remove, those actions usually need to be performed only on devices that were blocked during a previous Assemble run and are now in compliance. To avoid sending reinstate or remove actions to all ActiceSync devices and only target those previously blocked by Assemble, set the key “activesyncactionhistory=yes” in the section [RuleNum]. Assemble will then skip over devices that were not blocked by Assemble during previous runs even if thousands of devices match the Assemble rule.VSP 5.5 Note: The action activesync:block does not work with VSP 5.5 due to an API problem. Use the action activesync:blockalt which uses an alternative method for blocking ActiveSync devices. That action requires an Assemble user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | Examples:activesync:blockactivesync:reinstateactivesync:wipe*activesync:remove*activesync:blockalt*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings |
| activesync:assignpolicy;policyname | Assigns an ActiveSync policy to the device.This action requires the key “activesyncpolicyid=yes” in the section [RuleNum]. | Example:Action=activesync:assignpolicy;UnregisteredDevicePolicy |
| lock | Sends a lock command to the device. This locks the screen. If a password/passcode is set the user will have to enter it to unlock the screen | Example:Action=lock |
| unlock | This action is only supported on Android and iOS devices. Unlocking the device clears its passcode.Notes:• This function does not apply to Android devices locked using face or pattern locks.• Because the Ivanti app cannot remove the passcode on an encrypted Android device, the Unlock command sets the passcode to "un!ockm3!" on encrypted devices.• On Android devices using AppConnect apps, unlock also removes the secure apps passcode.For details, see “Lock, unlock, and retire impact on AppConnect for Android” in the admin guide for Core. | Example:Action=unlock |
| location:record |
This records the following location information for the device in location_history.ini:[UUID]principal=principal(username)emailAddress=emailaddressemployeeOwned=true or falsemanufacturer=device manufacturermodel=device modelphoneNumber=device phone numberplatform=OS and versionuserDisplayName=user display namelocation_1_time=time stamp of last reported locationlocation_1_lat_long=-latitude,longitude of last reported locationlocation_1_locationaddress=street address of last reported locationlocation_1_maplink=Google Maps hyperlink for last reported locationThis information can be used to create a report of the last X number of reported locations. The number of location recorded is dependent on the setting “location_history_entries” in the section [RuleNum].See Location History Report for instruction on creating a location history report. |
Example:Action=location:record |
| message | Sends messages as a primary action. In previous Assemble versions sending push, SMS or email messages were only secondary actions. | Example:Action=message |
| *ownership:corporate|employee*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | Changes the ownership of the device to corporate or employee. If the device is already classified as such the action will be ignored.If the action changes, the built in label company-owned or employee owned will be applied and the opposing label will be removed. | Example:Action=ownership:corporate |
| pushprofile:name:all|matching | When set as “pushprofile:name:all” this action pushes all profiles to all matching iOS devices. Non-iOS devices will be skipped for this action because pushing profiles for other operating systems is not supported. This automates the action of choosing a single iOS device in Users & Devices -> Devices, clicking Push Profiles, choosing all profiles and clicking Push Profile.NOTE: If an Exchange policy is pushed, it will first be pulled from the device before being applied. This will wipe email from the device and force a re-sync. Most policies will not be applied until the device is unlocked.When set as “pushprofile:name:matching” this action pushes only the profile to devices matching the trigger “profile:profilename:statustring”.Example:[Rule1]NumberofElements=1Action=pushprofile:name:matchingActionReason=System - iOS MDM is Pending reportingreportsend=yesreportname=iOSMDMPendingReportreportlocation=C:\assemble\reports\reportmessage=iOS MDMPendingReportreportvar=uuid,principal,currentphonenumber,emailaddress,manufacturer,ModelName,model_universalreportprofiledetails=yesElement1_trigger=profile: System - iOS MDM:PendingElement1_description=System - iOS MDM is Pending | Examples:Action=pushprofile:name:allAction=pushprofile:name:matching |
| roaming_voice_data:true|false:true|false | Enables or disables voice and/or data roaming on iOS devices. Not all iOS devices voice roaming settings can be controlled. This varies between cellular carriers and iOS versions. If voice roaming cannot be changed, the logs will reflect this limitation with the following entry.Current Voice Roaming Setting: N/AThe settings for this action for voice and data are separated by a colon. Both are must be set with true or false. roaming_voice_data:voicesetting:datasettingIf the desired action cannot be applied to the device because it is not supported (i.e. disabling voice roaming), the action will not be taken. If the desired action matches the current setting on the device (i.e. disable data roaming when data roaming is already disabled), the action will not be taken. | Example:roaming_voice_data:true:false |
| *multiusersignout*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager SettingsThis action is only supported in VSP 5.1 and higher. | Utilizes the multiuser feature introduced in 5.1 to signout the user from the device which removes the user’s policies and specified managed apps from the device. | Example:Action=multiusersignout |
| *Found*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | This action changes the status of a device from Lost to Active.This action also requires the key setting “activedevicedownload=LOST” be included in the [RuleNum] section to allow Assemble to download a list of all the devices with the status LOST. | Example:Action=found |
| *Lost*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | This action changes the status of a device from Active to Lost. | Example:Action=lost |
| *comment*This action requires a user account with both the API role AND the roles Smartphones Inventory, Policies, and Smartphone Manager Settings | This action edits the comment for the device in the VSP GUI.The key commentstring must also be set.The comment can also include any device variable values by setting the key “commentvar” in the [RuleNumX] section. Just like the key “reportvar”, any device variables can be included.Example:action=commentcommentstring=mycommentcommentvar=principal,serialnumberIn this example, the comment string that will be added will be in the following format:mycomment;jsmith;DNQJR80NDTTQ: 2013-04-19 10:54 | Example:Action=comment |
| samsung_kiosk:enable|disable | This action will enable or disable kiosk mode on Samsung SAFE devices with a Kiosk policy applied. This action is the same going into Actions and choosing Enable Samsung Kiosk ir Disable Samsung Kiosk in the Devices screen of the VSP. | Example:Action=samsung_kiosk:enable |
| delete*supported in VSP/Core version 7.0 and higher | This key will delete matching retired devices from the VSP/Core appliance. If the device status is not “RETIRED”, Assemble will ignore the device action.The Assemble account must have the role “Delete retired device (API only)”. You must also specify the account’s Admin Space ID in the key “adminDeviceSpaceID” in the section [RuleNum]. The ID for the default VSP/Core Global space is “1” and is also the default setting for the key “adminDeviceSpaceID”.Note: The devices are deleted only if they have been retired for more than one day (24 hours). | Example:Action=delete |
| compliancecheck | This updates the compliance status of matching devices without waiting for the scheduled compliance check to run. | Example:Action=compliancecheck |