Security policies

Name

Required. Enter a descriptive name for this policy. This is the text that will be displayed to identify this policy throughout the Admin Portal. This name must be unique within this policy type.

Though using the same name for different policy types is allowed (e.g., Executive), consider keeping the names unique to ensure clearer log entries.

Priority

Specifies the priority of this custom policy relative to the other custom policies of the same type. This priority determines which policy is applied if more than one policy is associated with a specific device. Select “Higher than” or “Lower than”, then select an existing policy from the drop-down list. For example, to give Policy A a higher priority than Policy B, you would select “Higher than” and “Policy B.”

Because this priority applies only to custom policies, this field is not enabled when you create the first custom policy of a given type.

Password Type

Specify general restrictions for the password:

Simple: Determines whether a simple password is allowed. A simple password can contain repeated characters, or ascending/descending characters, for example 123 or CBA.

Alphanumeric: Requires passwords to include at least one letter and one number.

For iOS, tvOS , and macOS : If you select both Simple and Alphanumeric, then passwords can include repeating and/or ascending/descending characters. If you select Alphanumeric only, then passwords may not include repeating and/or ascending/descending characters.

Don’t Care: Applies the default requirements specified by the device OS. This option is not supported on iOS.

If no check box is selected, the Password Type defaults to Don’t Care.

For Android 12: Android 12 devices in Work Profile mode do not support password type and password length. As a result, they are reported in Ivanti EPMM as "Unsupported."

For Windows Phone 8.1 devices: The Don’t Care option requires that the password is either simple or alphanumeric.

To allow the use of a PIN, but not a simple password such as 1234 or 1111, select the Don’t allow simple password option.

For Windows 10 Mobile devices: This feature is not supported. Use Minimum Number of Complex Characters to make changes to these keyboards.

Minimum Password Length

Enter a number between 1 and 16 to specify the minimum length for the password. Leave this setting blank to specify no minimum.

Note the following:

• For Android devices: When the Don't Care option is set for the Password Type field, the Minimum Password Length field does not apply.
• For Android 12: Android 12 devices in Work Profile mode do not support password type and password length. As a result, they are reported in Ivanti EPMM as "Unsupported."

Minimum Number of Complex Characters

Specify the minimum number of special characters that must be included in a password.

For Windows Phone 8.1 devices: Specify the minimum level of complexity, 1 to 4, required in a password. The values indicate the minimum number of character types required. The character types are lowercase, uppercase, numbers, and non-alphanumeric.

For Windows 10 Mobile devices: The complexity will determine what type of password and keypad the user sees. 1 - Digits only (the default)2 - Digits and lowercase letters are required3 - Digits, lowercase letters, and uppercase letters are required4 - Digits, lowercase letters, uppercase letters, and special characters are required.

For Windows 10 Desktop devices: This feature is not supported.

Maximum Number of Failed Attempts

This feature does not apply to Windows devices.

Specify the maximum number of times the user can enter an incorrect password before the device is wiped. 0 indicates no limit.

For Android and Android Enterprise devices: When set to zero, unlimited passcode failures are allowed. When set to anything greater than zero only the number of consecutive failures specified are allowed.

For iOS and tvOS: When set to a maximum number of 3 or less, the device imposes a time delay before a passcode can be entered again. The time delay increases with each failed attempt, as shown in the following table.

For example, if the device user has failed to enter the correct password for the 7th time, a wait time of 5 minutes is imposed, for a total wait time of 6 minutes, even when the maximum number of failed attempts has been set to 3.

When set to 4 or above, devices that can no longer be disabled by users are wiped when entering the fifth incorrect passcode. There is no wait time in this case.

When set to 3 or less, and enabling the iOS or tvOS setting to erase the device after too many failed passcode attempts (under Settings > Touch ID & Passcode > Erase Data in iOS), the device is wiped when entering the 11th failed passcode.

If there is no passcode set on the device, data protection is disabled by default. This is as per Apple design.

Maximum Number of Failed Attempts

If this is set as 1, the user is not prompted to enter the device password.

This feature specifies the number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality.

This policy must be wrapped in an Atomic command.

Prior to reaching the failed attempts limit, the user is sent to the lock screen and warned that more failed attempts will lock their computer. When the user reaches the limit, the device automatically reboots and shows the BitLocker recovery page. This page prompts the user for the BitLocker recovery key.

The following list shows the supported values:

• An integer X where 4 <= X <= 16 for desktop and 0 <= X <= 999 for mobile devices.
• 0 (default) - The device is never wiped after an incorrect PIN or password is entered.

The most secure value is 0 if all policy values = 0; otherwise, Min policy value is the most secure value.

Maximum Number of Failed Attempts

For Windows 10 Desktop devices: When a user reaches the value set by this policy, it is not wiped, but put on BitLocker recovery mode, which makes the data inaccessible but recoverable. If BitLocker is not enabled, then the policy cannot be enforced.

Grace Period for Device Lock

For macOS only: Specify the maximum amount of time the device can be on the screen saver without prompting for a passcode on wake from the screen saver.

For iOS and tvOS only: Specify the interval after the device locks during which the user can unlock the device without entering a passcode.

Device Encryption

For Android Samsung Knox: Select On to turn on encryption. Otherwise, select Off.

If Device Encryption is turned on, then the Password option is automatically set to Mandatory.

For Windows: Setting encryption is supported for Windows Phone 8.1 and Windows 10 Mobile devices. Setting encryption is not supported for Windows 10 Desktop devices, however, encryption can be enabled by setting it manually on the device.

Once encryption has been set, looking up encryption is supported for all Windows devices.

If Device Encryption is turned on, it cannot be turned off. You must reset the device to factory settings to turn off device encryption.

File Types

For Android devices only: Indicates the file type.

Device Log Encryption

Select On to turn on device log encryption. Otherwise, select Off.

See “Device log encryption” in the Device Management Guidefor Android Devices.

Common Criteria Mode (Samsung Knox and LG only)

For Android 7.0 devices and supported newer versions:

This feature is not commonly used.

For customers that require this mode, select this check box to put a Samsung Knox or LG device in Common Criteria mode.

For Samsung Knox devices, selecting this option requires a Knox license and the Samsung General policy needs to be enabled.

Apply to Samsung Managed devices

This feature is not commonly used.

For customers that require this mode, select this check box to put a Samsung managed device in Common Criteria mode.

This option is supported only on Android 7.0 and supported newer versions.

Block Smart Lock Options (from Android 6.0)

These fields appear only if you have selected Block Smart Lock (from Android 6.0 only).You must select at least one of these options.

Support for each of these options vary across device models. Selecting an option has no impact on devices that do not support the option.

Block NFC

This field appears only if you have selected Block Smart Lock (from Android 6.0 only)

Select to not allow unlocking a device because it is connected to a trusted device using NFC (near-field communication).

Some device models combine Bluetooth and NFC into trusted devices.

Block Face

This field appears only if you have selected Block Smart Lock (from Android 6.0 only)

Select to not allow unlocking a device because it recognizes the user's face, also known as a "trusted face".

Block Voice

This field appears only if you have selected Block Smart Lock (from Android 6.0 only)Select to not allow unlocking a device because it recognizes the user's voice.

Block Iris Scan (Samsung and Android 9.0)

For Android devices only:

Select this option to prohibit the device user from using iris scanning to unlock the device. This option requires that the device is:

• A Samsung device with the iris scanning feature.
• A Samsung device running Samsung OS 7.0 through the most recently released version as supported by Ivanti EPMM.
• A non-Samsung device running Android 9.0 through the most recently released version as supported by Ivanti EPMM.
• Running Ivanti Mobile@Work 10.1 through the most recently released version as supported by Ivanti EPMM.

This setting has no impact on other devices.

This security policy setting overrides the Lockscreen Widgets setting in the lockdown policy.

Require Google SafetyNet Attestation

For Android devices only: Select this option to perform SafetyNet attestation on devices. See "Enabling SafetyNet attestation on Android devices" in the Ivanti EPMM Device Management Guide for Android and Android Enterprise devices.

Allow only redacted notifications on lock screen

Android Enterprise work profile only: This option will redact notifications shown on the lock screen hiding the notification contents. Block notifications on lock screen does not affect this. Applies to Managed Device with Work Profile (COPE) mode on Android devices versions 8-10.

Firewall

This is available on all Windows-supported devices.

Auto-Update

This is available on all Windows-supported devices.

Defender Real-time Protection

This setting is turned on by default. Once a user turns it off it can only be turned back on by an administrator.

Apply compliance action when a policy has been out of date for x days

Select the compliance action you want to apply if a device has not met policy requirements for the specified number of days.

For iOS devices: All compliance actions are supported.

For macOS devices: You can send an alert and quarantine the device.

For Android devices: Supports only the following compliance actions:

• Sending alert
• Blocking email access if you are using a Standalone Sentry for email access.
• Blocking app tunnels.

For Windows devices: Supports only the following compliance actions:

• Sending alert
• Blocking email access if you are using a Standalone Sentry for email access.
• Supported custom compliance actions.

Apply compliance action when a compromised iOS device is detected

Select the compliance action you want to apply when Ivanti EPMM detects an iOS device that has been modified to circumvent manufacturer restrictions.

In Ivanti Mobile@Work, if the compliance action specifies Enforce compliance actions locally on devices, the following compliance actions, if selected, are enforced on the device without connecting to Ivanti EPMM:

• Alert the device user with a banner or notification.
• Block AppConnect apps.
• The device user becomes unauthorized to use AppConnect apps.
• Retire AppConnect apps.
• The device user becomes unauthorized to use AppConnect apps and the apps’ secure data is deleted.

All other compliance actions require the device to be connected with Ivanti EPMM.

Apply compliance action when device MDM is deactivated (iOS 5 or higher)

Select the compliance action you want to apply when Ivanti EPMM detects that the MDM profile has been removed from the device.

Only join Wi-Fi networks installed by profiles (iOS 10.3 and later with supervised devices only)

Enabling this option filters the Wi-Fi network choices that devices can join to only include the Wi-Fi networks installed by profiles. Toggling the value of this option causes Ivanti EPMM to push the Wi-Fi configurations to any devices with this security policy.

Apply compliance action when Data Protection is disabled

Select the compliance action you want to apply when Ivanti EPMM detects an iOS device that has the Data Protection feature disabled.

Note: If the data protection feature is required for devices in the security policy, or if the password requirements are imposed, tvOS devices will fail to satisfy the policy because Apple does not support password requirements. To impose this requirement on your devices, create a separate policy for tvOS devices.

Apply compliance action when macOS version is less than

Select a compliance action to apply when the macOS version on the device is less than the version you select from the drop-down list.

Apply compliance action when device MDM is deactivated

Select a compliance action to apply when the MDM (mobile device management) profile is deactivated on the device.

Apply compliance action when Android version is less than x

Select the compliance action you want to apply when Ivanti EPMM detects an Android device having a version number less than the specified version.

Apply compliance action when Data Encryption is disabled

Select the compliance action you want to apply when Ivanti EPMM detects an Android device that has the Data Encryption feature disabled.

The quarantine action Remove All Configurations has no impact when data encryption is disabled.

Apply compliance action when device administrator is deactivated

Select the compliance action you want to apply when Ivanti EPMM detects that the device administrator privilege has been removed from the Ivanti Mobile@Work app.

The quarantine action Remove All Configurations has no impact when the device administrator is deactivated.

Bypass Factory Reset Protection

Applies to Android Enterprise devices in “work managed” mode only.

When enabled, Android’s Factory Reset Protection feature is bypassed, and factory reset devices will be unlocked.

When disabled, Android’s Factory Reset Protection is active. A factory reset device will be locked and will require the owner’s Google Account credentials before the device can be set up again.

No administrative code exists to unlock a factory reset device if bypass is disabled.

Apply compliance action when Windows version is less than x

Select the compliance action you want to apply when Ivanti EPMM detects an Windows device having a version number less than the specified version.

Apply compliance action when Data Encryption is disabled

Select the compliance action you want to apply when Ivanti EPMM detects a Windows Phone 8.1 device that has the Data Encryption feature disabled.