Required Apps (SecureHub)

[Fabian Hässelbarth1709154982]

Hello,

first of all: I don't get it.

 

We set up 'SecureHub' (a VPP app) as an required app for our DEP group.

The result is every DEP device gets 'Secure Hub' silently after iOS FTU wizard without the need of an Apple-ID. Fine.

 

Unfortunately one user deleted 'SecureHub'. No problem I thought. 'SecureHub' will be pushed again anyway and then the user can enroll the device again. But nothing was pushed. Ok, maybe I have to trigger 'deploy' for that specific user. But nothing was pushed. 

 

After all we setup 'SecureHub' as an required app for every delivery group. But it still doesn't work. 

 

All other apps like 'SecureMail' or 'SecureWeb' are pushed again but 'SecureHub' not. 

 

The funny part is that 'SecureHub' is pushed and installed silently again for BYOD devices when users uninstall them. 

 

My questions are: 

- can I prevent users from uninstalling/deleting  apps?

AND

- how do I deploy 'SecureHub' to DEP devices after someone deleted it?

[Jan-Paul Plaisier]

You can prevent uninstalling apps via a restriction policy but this will only work on supervised iOS devices...

[Kausar Tasneem]

Hello,

 

Can you try the below :

 

1. SecureHub set as a REQUIRED app in a DeliveryGroup

 

2. SecureHub application is set to deploy on EVERY CONNECTION ( setting this to Only when previous deployment has failed will break the XMS push logic, as removal of the app does not equate a FAILURE, rather will be considered ManagedButUninstalled)

 

3. XM Server property enabled - force.server.push.required.apps = true (setting this property requires a server reboot to take affect)

 

If the above steps help, please mark the topic as answered.

 

Thanks,

Kausar

[Fabian Hässelbarth1709154982]

 

Hello,

 

Can you try the below :

 

1. SecureHub set as a REQUIRED app in a DeliveryGroup

 

2. SecureHub application is set to deploy on EVERY CONNECTION ( setting this to Only when previous deployment has failed will break the XMS push logic, as removal of the app does not equate a FAILURE, rather will be considered ManagedButUninstalled)

 

3. XM Server property enabled - force.server.push.required.apps = true (setting this property requires a server reboot to take affect)

 

If the above steps help, please mark the topic as answered.

 

Thanks,

Kausar

 

 

1. already is (for every DeliveryGroup we set up)

2. already is 

3. 'force.server.push.required.apps' is not available in server properties. Can you confirm? I will add the key and give it a try.

 

 

You can prevent uninstalling apps via a restriction policy but this will only work on supervised iOS devices...

 

@Jan-Paul

All DEP devices are in supervised mode. But this policy will prevent uninstalling ANY app even those which were installed by user from Apple App Store. Correct?

[Jan-Paul Plaisier]

Yes, this will prevent uninstalling all apps.

[Kausar Tasneem]

Yes, it's not available in server properties . We need to add as custom key.

 

Thanks,

Kausar

[Fabian Hässelbarth1709154982]

Yes, it's not available in server properties . We need to add as custom key.

 

Thanks,

Kausar

 

This server property doesn't work. Now not even other SecureApps are beeing pushed.

Is that server property key correct? Spelling? Typo?

[Kausar Tasneem]

Yes, that's correct force.server.push.required.apps , I have set it in my lab and it works fine.

 

1)Under XenMobile settings --- > Server properties

2) Add server property 

• Key= Custom Key
• Key* = force.server.push.required.apps
• Value= True
• display name = Force required app 
• Description = you can put the same as display name

 

 

Regards,

Kausar

[Fabian Hässelbarth1709154982]

Yes, that's correct force.server.push.required.apps , I have set it in my lab and it works fine.

 

1)Under XenMobile settings --- > Server properties

2) Add server property 

• Key= Custom Key
• Key* = force.server.push.required.apps
• Value= True
• display name = Force required app 
• Description = you can put the same as display name

 

 

Regards,

Kausar

 

How long did you wait for SecureHub? Maybe I'm just impatient. I gave it a try over night. Is that too short?

[Kausar Tasneem]

How long did you wait for SecureHub? Maybe I'm just impatient. I gave it a try over night. Is that too short?

Fabian,

 

May be you can try rebooting the server once. It shouldn't take too long.

 

Thanks,

Kausar

[Fabian Hässelbarth1709154982]

I did reboot all server nodes. But no change.

 

No required apps are beeing pushed now. Neither SecureHub nor other SecureApps like SecureWeb or SecureMail.

[Kausar Tasneem]

Fabian,

 

I would suggest to open a Support ticket as it needs more depth troubleshooting. 

 

Thanks,

Kausar

[Fabian Hässelbarth1709154982]

Is it possible that xenmobile cluster is causing the problem?

 

http://docs.citrix.com/en-us/xenmobile/server/install-configure/server-properties.html

In docs the key is: force.push.required.apps.flag

 

You said it is: force.server.push.required.apps

 

I'm confused.

[Kausar Tasneem]

Is it possible that xenmobile cluster is causing the problem?

 

http://docs.citrix.com/en-us/xenmobile/server/install-configure/server-properties.html

In docs the key is: force.push.required.apps.flag

 

You said it is: force.server.push.required.apps

 

I'm confused.

This is what is mentioned in docs :

 

force.server.push.required.apps

Enables the forced deployment of required apps on Android and iOS devices in situations such as the following:

• You upload a new app and mark it as required.
• You mark an existing app as required.
• As user deletes a required app.
• A Secure Hub update is available.

Forced deployment of required apps is false by default. Create the custom key and set Value to true to enable forced deployment. During forced deployment, Enterprise apps upgrade immediately even if you set an App update grace period and the user taps to upgrade the app later.

Key: Custom Key

Key: force.server.push.required.apps

Value: false

Display name: force.server.push.required.apps

Description: Force required apps to deploy

Where is the value force.push.required.apps.flag mentioned ?

[Brian Schmidt Pedersen1709153674]

Are you deploying Secure Hub only to the "Device Enrollment Program Package" group?

 

If so I have found that apps and policies that are deployed only to that group, will only be deployed until the moment the user actually authenticates, either during the DEP enrollment or when signing into (and finalizing enrollment) Secure Hub.

 

I noticed it when enabling "Require credentials for device enrollment" under DEP settings, that then Secure Hub would not install until I modified the deployment to include a delivery group where the authenticated user was in.

[Sebastian Grieser1709161458]

There is a workaround. Not really good, but it works:

 

-  you have to use Enterprise licences (MDM & MAM) on the server.

-  deploy Secure Hub as a required app with "force licence association to device"

-  log on to the MDM Sever and create an iOS store policy at Configure > Device Policies > Add > Store and deploy it to your devices.
It serves as a Shortcut on the home screen of the ios device. If you open it, it leads inside the Secure Hub Store. This is still available after accidently deleting Secure Hub, if the MDM profiles are still intact. From the store you can install Secure Hub again, no new enrollment via factory reset required.