Imprivata MDA Requirements

Android native lock screen

The following Android packages cannot be restricted:

• com.android.systemui

• com.android.settings

• com.android.nfc

• com.google.android.nfc (for Android 16 devices)

Upload the Imprivata appliance certificate to the MDM when deploying Imprivata MDA to a device.

• {{SerialNumber}} - Microsoft Intune

• {DeviceSerialNumber} - Omnissa Workspace ONE

• %SERIALNUM% - Soti

Depending on your MDM, represents the serial number of the device.

Imprivata MDA checks for Imprivata appliance server certificate validity and allows you to check whether Imprivata appliance certificate is configured correctly.

• {{SerialNumber}} - Microsoft Intune

• {DeviceSerialNumber} - Omnissa Workspace ONE

• %SERIALNUM% - Soti

Set the domain selected by default when the user authenticates to Imprivata MDA with their username and password.

.

Sets a string pattern containing the supported variables to identify the device, that will be replaced with actual device-specific strings.

For the supported values, see the table of supported mobile policy values available for override.

• Allows communication with an Imprivata appliance that contains any seIf-signed or expired or invalid certificate.

• If allowUntrustedEAMCertificate is set, then forceTrustedEAMCertificate is ignored.

Sets the order of MDA logout operations to log the browser out last.

This AppConfig allows backwards compatibility to support the order of logout operations used in earlier releases of MDA.

When bootLockDelay is in effect, the device cannot be unlocked.
The purpose of this flag is to allow the SIM PIN to be entered into the device. The user cannot freely unlock and use the device normally.

The delay timer only starts when the device has finished rebooting.

• The assigned integer value defines the delay in seconds.

• The maximum delay time is 60 seconds.

• If the integer is not present, is 0 or negative, the flag is ignored.

• If the integer entered is more than 60 seconds, the flag applies the maximum delay of 60 seconds.

Allows users to enroll their unenrolled FIDO2 security keys from the Imprivata MDA app.

If treatNfcTapAsProx is set, Imprivata MDA will ignore fidoEnrollmentOn.

Use Samsung DeX functionality.

The device prompts for the required Device Administrator permissions and activates required Knox SDK license.

Enables the Samsung DeX session to stop when MDA is signed out.

For customers with proximity cards that communicate with the same protocol as FIDO2 security keys, treatNfcTapAsProx enables proximity card-only mode.

• If treatNfcTapAsProx is not set, FIDO2 security keys previously enrolled as proximity cards will fail to authenticate to MDA 8.1 and later.

• If treatNfcTapAsProx is set, Imprivata MDA will ignore fidoEnrollmentOn.

emergencyCalls

emergencyCalls:<phone number>

emergencyCalls:<phone number>|skipConfirmation

Allows the user access to the phone dial pad so they can make phone calls from the Imprivata MDA lock screen, without the user needing to authenticate to the device.

To define a preconfigured phone number, set the <phone number> value to the phone number needed.

Supports US and International phone number formats.

Sets the Imprivata MDA foreground service notification to be non-cancellable.

• The user will not be able to dismiss the notification from the Android notifications bar by swiping.

• The notification will always be available in the notification bar.

Beginning with 10.1, Imprivata MDA draws Conent view UI on MDA Lock screen notifications by default.

In previous releases, Imprivata MDA didn't show notification contents from Custom Content view if a notification had one, resulting in an empty notification shown over the Imprivata MDA Lock screen.
The flag ignoreCustomContentView enables the previous MDA behavior of ignoring the Custom Content view set in notifications.

Sets the domain name to use when building UPN formatted usernames for MSAL login that is enabled by the msalLoginOn flag.

This flag is useful when the EAM user identity is configured with a different domain name than the Microsoft Entra ID domain name.

Without the msalLoginOn flag setting msalLoginDomain has no effect.

Overrides the MSAL sign-in timeout.

Default is 15000 ms.

Example: msalLoginTimeout=30000.

msalLoginOn

Allows a delay, in milliseconds, before Imprivata MDA starts processing AutostartApps.

Allows a delay, in milliseconds, between AutostartApps launch attempts.

Lock the device when Imprivata MDA detects the device is charging

Used with logoutOnCharge

Log the user out from the apps when Imprivata MDA detects the device is charging.

Used with lockOnCharge

Require the user to reauthenticate when Imprivata MDA transitions from offline to online, only when the user session was last unlocked in offline. The flag has no effect on online established sessions.

Used in combination with allowOfflineMode.

Use the Zebra SDK for all SDK based logout methods.

Setting deviceSdkLogout is equivalent to setting the following three values:

• deviceSdkClearData

• deviceSdkClearData

• deviceSdkForceStop

Prevent users from accidentally typing characters into credentials screens.