Configure Zebra Enterprise Home Screen

Use Zebra Enterprise Home Screen (EHS) as a qualified launcher for Imprivata MDA on Zebra Android devices, deployed through your MDM. EHS is a free Android app from Zebra Technologies that replaces the native launcher and locks the device down to a configured set of apps, configured through an XML file and deployed by your MDM.

Prerequisites

Take note of the following prerequisites:

  • Zebra devices running Imprivata MDA 10.0 and later.

  • Zebra Enterprise Home Screen 6.0 or later, available from Google Play or from the Zebra Developer portal.

    For more information, see the Zebra EHS documentation.

Limitations

Consider the following limitations:

  • Not compatible with Microsoft Intune's Managed Home Screen (MHS). Zebra EHS and Intune MHS cannot be used together on the same device.

  • Not supported with face recognition as an authentication method. Use one of the other supported authentication methods instead.

Configure the MDM for Imprivata MDA and Zebra EHS

Add and assign the Imprivata MDA and Zebra EHS apps to your devices.

  1. In your MDM's admin console, add and assign the Imprivata MDA app to the device group.

  2. Configure the Imprivata MDA AppConfig keys as required for your deployment.

  3. Add and assign the Zebra Enterprise Home Screen to the same device group as Imprivata MDA.

For general Microsoft Intune setup steps, see Using Microsoft Intune to Deploy Imprivata MDA. This example builds on that procedure and does not repeat it.

  1. Log in to the Microsoft Intune admin center.

  2. Select Apps > Android Apps and click Add.

  3. Select Managed Google Play app from the App type list and click Select.

  4. In Managed Google Play, search for Zebra Enterprise Home Screen (com.zebra.mdna.enterprisehomescreen) and click Approve.

  5. Select Keep approved when app requests new permissions.

  6. Click Sync. The app is added to the Android apps list.

  7. Assign Zebra Enterprise Home Screen to the same user or device group you used for Imprivata MDA. Set the assignment type to Required so the app installs automatically at enrollment.

Configure Zebra EHS to Allow Imprivata MDA

Zebra EHS is configured through an XML file (enterprisehomescreen.xml) that defines which apps users can launch, which device settings are locked down, and which apps EHS itself is permitted to launch on behalf of the user.

Imprivata MDA must be listed in the EHS allowed-applications list. Zebra recommends that any other managed apps that users need to access on the device be listed there as well.

For the full XML schema and parameter reference, see the Zebra documentation.

Example

The following example of enterprisehomescreen.xml is a minimal configuration that permits Imprivata MDA:

Copy 
<wap-provisioningdoc>
  <characteristic type="EnterpriseHomeScreen">
    <parm name="AllowedApplications">
      <characteristic type="Application">
        <parm name="package" value="com.imprivata.imda"/>
        <parm name="name" value="Imprivata MDA"/>
      </characteristic>
      <!-- Add additional <characteristic type="Application"> blocks
           for every other app users need to launch. -->
    </parm>
  </characteristic>
</wap-provisioningdoc>

Deploy enterprisehomescreen.xml to your Zebra devices using the EHS app configuration policy.

Set Zebra EHS as the Default Launcher

Use a device configuration profile to make Zebra EHS the default home app, so users do not see the Android launcher selector after enrollment.

  1. In the Microsoft Intune admin center, select Devices > Configuration profiles > Create profile.

  2. Select Android Enterprise for the platform.

  3. Select Fully managed and dedicated devices, then select Device restrictions and click Create.

  4. On the Device restrictions page, enter a name and click Next.

  5. On the Configuration settings page, expand the Device experience section and set the Custom home screen app (or equivalent setting) to the Zebra Enterprise Home Screen package: com.zebra.mdna.enterprisehomescreen.

  6. Click Next.

  7. On the Assignments page, select the user groups to include and click Create.

Set Up Zebra EHS with Imprivata MDA

For Zebra EHS and the Imprivata MDA app to work successfully together, configure EHS to leave the Android Settings app enabled in User mode.

When the Zebra EHS app is installed on the device, the Device Settings app is hidden by default, as part of the lockdown features of EHS.
To unhide the Device Settings app:

  1. Add the following XML to the EHS configuration file:

    Copy 
    <system_settings_restricted>0</system_settings_restricted>
        <apps_enabled>
            <application package="com.android.settings"/>
        </apps_enabled>

- OR -

  1. Access the Admin mode, tap the menu (three dots) > Preferences > Disable any application.

  2. From the list of available apps, find Settings and remove the checkmark from it.

  3. In Preferences, go to System Settings restricted and select Full Settings.

Block the user from having access to the Android Settings application by disabling the Notification Pulldown bar.

To disable the Notification Pulldown bar:

  1. In the Zebra MX UIMgr Configuration, add the following XML:

    Copy 
    <wap-provisioningdoc>
     <characteristic version=“11.5" type=“UiMgr”>
       <parm name=“NotificationPullDown” value=“2” />
       <parm name=“AppInfoIconOnRecentAppHeader” value=“2” />
     </characteristic>
    </wap-provisioningdoc>

Verify the Deployment

After enrollment, confirm the following on at least one device:

  • The device boots into Zebra Enterprise Home Screen as the home app, with no launcher selector prompt.

  • Imprivata MDA is reachable from the EHS launcher and starts cleanly.

  • A user can authenticate using a proximity card, FIDO security key, or username and password.

  • A user can launch each managed app from the EHS launcher and is signed in by Imprivata MDA.

  • On logout, Imprivata MDA signs the user out of all managed apps and applies the configured Web Browser Management action.

  • Notifications behave as configured in the Imprivata mobile policy.

  • A user switch completes successfully.