Configure the Mobile Policy and User Authentication

To configure device settings:

1. Go to the Access Management section.

2. (Optional) Select Allow guest mode.

   By default, users must authenticate to access the device. When enabled, users can tap Guest to access the device without having to authenticate. When a user access the device in this way, single sign–on is not available.

3. (Optional) Select Automatically log out a user.

   By default, a user's session remains active until the user logs out or a user switch occurs. You can specify a duration after which time the authenticated user is automatically logged out.

4. (Optional) Select Inactivity re-authentication.

   By default, a user's session remains active until the user logs out or a user switch occurs. You can specify a duration after which time the device is locked and the user is required to re–authenticate.

5. (Optional) By default, users authenticate using a proximity card. You can:

   • Add an Imprivata PIN or password as a second factor.

     Select Turn on grace period for second authentication factor, and specify the grace period.

     The grace period is the time during which subsequent authentications do not require the second factor.

   • Enable the policy for a username and password + an Imprivata PIN.

     Select Unlock with Imprivata PIN instead of proximity card, and specify the grace period.

     The grace period is the time during which subsequent authentications require an Imprivata PIN only.

     Use this setting when configuring Countdown to lock mode to renew a session using the Imprivata PIN.

By default, all open Google Chrome and Zebra Web browsers are closed when a user logs out or during a user switch.

To change the default web browser data settings:

1. Go to the Web Browser Management section.

2. (Optional) Enable one of the settings:

   • Do nothing

   • Force stop all browsers — Stops all related browser services.

   • Clear cache on all browsers — Clears all cached images and files.

   • Clear data on all browsers — Clears the cache and deletes all data associated with the browser.

By default, the Imprivata appliance does not check whether user credentials have been changed outside of EAM (out of band). If a user has updated their password out of band, authentication fails.

When enabled, Imprivata MDA checks for an out of band password change before authentication:

• If detected, the user is prompted to reenter their credentials.

• After the user successfully authenticates, the new credentials are saved.

To check for an out of band password change:

1. Go to the Authentication section.

2. (Optional) Select Validate stored domain credentials before authenticating.

Customization settings let you:

• Specify which push notifications are allowed to appear on the home screen.

  By default, Imprivata MDA blocks the push notifications from all apps from appearing on the home screen.

To configure customization settings:

1. Go to the Customization section.

2. In Imprivata MDA 7.14 and later, the language is controlled by the device level localization settings, commonly configured in your MDM, and not by the mobile policy.

3. (Optional) Select Allow lock screen notifications, and enter the package name for each application whose push notifications should be allowed. Configurations in each setting apply only to a related notification type.

   IMPORTANT:

   Notifications may contain sensitive information, such as PHI or private data, and can be read while the device is locked.

   Users can interact with notifications based on the following settings:

   • Voice call (VoIP) apps (no authentication required to answer call) — Users can answer or decline a voice call from the Imprivata MDA home screen.

   • Voice call (VoIP) apps (authentication required to answer call) — A notification appears on the home screen stating that there is an incoming call. Users must authenticate to the device to answer or decline the voice call.

   • Messaging and other apps — A notification appears on the home screen stating that there is a notification. Users must authenticate to the device to read it.

     The following attributes are supported for each of these settings, separated by the pipe character "|":

     • skipSound indicates that MDA will not play a notification sound for the app for the notification type.

     • cancelWhenNoUser indicates that MDA will not display a notification on the MDA lock screen when there is no logged in user.

       For regular messaging notifications, add the notification canceling flag to the Messaging and other apps setting.

       Example

       

        

     • skipEmptyCategory indicates that MDA will not display empty grouping notifications for alarm notifications and foreground service notifications that don't carry any useful information for the user.

     • partialWake indicates that when a notification is received, the screen won't be turned on, but the CPU will awaken.

     • skipWake indicates that when the device is in sleep or doze mode and a notification is received, the device will not wake.

     • lockOnLogoutFail indicates that MDA locks the device only on the specified app's logout failure; the prior user's session is preserved for re-authentication.

4. (Optional) Select Allow floating Home button. Applies to Workspace ONE Launcher configuration.