Check Out Devices via Imprivata Locker

Create an OTA Check Out Workflow and set up its associated automation rule.

1. In Name, enter Checked Out - OTA.

2. In Description, enter Check out iOS devices.

3. For Workflow Model, select Over the Air.

4. Select Add an action > Check Out Device.

5. Click Save.

Automation Setup

1. Go to Automation > New Rule.

2. In Name, enter Checked Out with Locker App.

3. Set a new trigger when a device is: Checked Out with Locker App.

4. Deploy these workflows:

• Checked Out - OTA.

Create an OTA Check In Workflow and set up its associated automation rule.

1. Go to Workflows > New Workflow.

1. In Name, enter Check In - OTA.

2. In Description, enter Check in iOS devices using Locker.

3. Select the Workflow Model: Over the Air.

4. Click Add an action > Check In Device.

5. From Logout Actions, select the apps to log the user out from.

   NOTE:

   Device passcodes are cleared during check in as long an MDM is enabled in device passcode management.

6. Click Save.

Automation Setup

1. Go to Automation > New Rule.

2. In Name, enter Check In with Locker App.

3. Set a new trigger when a device is: Checked In with Locker App.

4. Deploy these workflows:

• Check In - OTA.

IMPORTANT:

The Check In - OTA action must be the first Workflow in an automation chain.

To configure the Grab and Go feature at the global level in your organization, configure the Check Out settings:

1. In the MAM console, go to Admin > Check Out.

2. In the Check Out via Locker section, switch the toggle to ON.

3. In the Select Authentication Methods section, select the authentication methods as needed for your organization:

   1. Proximity badges.

      1. To allow users to enroll their badges at checkout, select Allow users to enroll badges to Enterprise Access Management from Locker app.

   2. Network username and password.

      Some organizations use special terms for username, such as "Network ID", "Net ID", or similar. You may customize the terms you use by editing the Username Label and Password Label fields.

      When enabled, the Locker app lock screen adds a button for users to type their network username and password to unlock the device.

      For EAM enterprises configured with multiple domains, the user selects their correct domain from a list box of domains.

      On successful checkout, Mobile Access Management can automate a Workflow. The automation must use the trigger When devices are unlocked via Network Username and Password, and the Workflow use the Over the Air Workflow model.

      

   3. Face authentication. For more information, see Face Recognition as an Authentication Method.

      NOTE:

      When using Face to check out via Locker, the user must be assigned to an EAM user policy that allows either Face + Imprivata PIN or Face + Password. Using Face as a first factor will always prompt the user for a second factor (Imprivata PIN or password) regardless of grace period.

   4. QR code.

4. Ensure the Require a second factor to unlock the device setting is ON.

5. Set the Locker Custom Options to allow the device to go to sleep at the Locker lock screen. This allows the devices to significantly reduce their battery usage.

6. Copy

   {
       "AllowDeviceAutoLock": true
   }

   If you already have Locker Custom Options defined for your devices, you can add this key/value pair to the JSON as an additional line:

   Copy

   {
       "UnlockPIN": "9999",
       "DefaultDomain": "example.com",
       "AllowDeviceAutoLock": true
   }

Configure the ability to Check In via Locker as the corresponding behavior.

1. In the MAM console, go to Admin > Check In.

2. In the Check In via Locker section, switch the toggle to ON.

   This allows users to log out of the device by tapping the Logout button in the Imprivata Locker app.

Test a small subset of your devices before deploying the authentication methods enterprise-wide by setting Locker Custom Options. Your testing can cover the following scenarios:

• Testing one or more devices before enabling a specific authentication method organization-wide.

• Enabling a Locker authentication method organization-wide, but excluding a specific group of devices.

Requirements

• The Check Out via Locker toggle must be set to ON for the Imprivata Locker app to respect the Locker Custom Options set for authentication methods.

Considerations

• The authentication method Locker Custom Options override any authentication methods set globally in the Admin > Check Out > Check Out via Locker > Select Authentication Methods section.

• Locker Custom Options are applied after the device is next checked in, when the device is locked and not actively performing any actions.

• Locker Custom Options key/value pairs are in JSON format.

  IMPORTANT:

  The key portion of Locker Custom Options key/value pairs are case-sensitive. The values may be case-insensitive.

Add Locker Custom Options to a Single Device

To apply the authentication method Locker Custom Options to a single device:

1. In the MAM console, go to Devices, and select the specific device from the Devices list. In the Device Details dialog, click Custom Options.

2. Click Edit, enter the key/value pairs in JSON format for the allowed authentication methods and click Save.

   JSON Syntax

   Copy

   {    
       "AuthMethodBadgeAllowed": true,
       "AuthMethodBadgeEnrollmentAllowed": true,
       "AuthMethodQRAllowed": true
   }

   If you already have Locker Custom Options defined for your devices, you can add these key/value pairs to the JSON as additional lines:

   Copy

   {   "UnlockPIN": "9999",
       "DefaultDomain": "example.com",
       "AuthMethodBadgeAllowed": true,
       "AuthMethodBadgeEnrollmentAllowed": true,
       "AuthMethodQRAllowed": true
   }

3. Click Deploy Workflow to deploy to the device.

Add Locker Custom Options to Multiple Devices

To apply the authentication method Locker Custom Options to multiple devices at once, add a Custom Options action to the Check Out Workflow:

1. In the MAM console, go to Workflows.

2. Select the Checked Out - OTA workflow.

3. Click Add an action > Advanced > Locker Custom Options.

4. Enter the key/value pairs in JSON format for the allowed authentication methods.

5. Click Save Workflow and deploy to the devices.