iOS 9 users have Day Zero support with Intune

Just a couple short months ago, Apple released the final version of iOS 9 worldwide and made a 9.1 beta available.  Apple has been hard at work to ensure Intune meets all compatibility requirements for their latest version of the Apple OS.  As a result of their efforts, Intune now has Day Zero managed support for iOS 9 devices.  All current Intune features won’t be affected and will still work as devices are upgraded to iOS 9.  All iPhone 6s and 6s Plus as well as the iPad Pro Tablet have iOS 9 installed.  When these devices begin to filter into enterprise organizations, Intune’s Mobile Device Management (MDM) will be under compliance with Day Zero support.

New Features

iOS 9 has several new features for users including an upgraded smarter version of Siri and multitasking for the iPad.  Networks may see a flood of new iOS 9 devices with demands to corporate network access so network administrators should prepare for this sudden rush.

iOS 9 also offers new configurations and enterprise features such as the new App Trust Flow.  This feature will prevent side loaded apps from launching by default.  The new MDM feature for iOS 9 is a setting called allowCloudPhotoLibrary which will disable the feature that syncs the device to the Cloud.  This is a good security feature that can prevent intentional and accidental syncing of corporate documents to the Cloud.

Another new setting is the allowUIAppInstallation which resolves issues caused by conflicting MDM controls that restrict the Apple App Store function which may cause issues when updating or installing apps.

One of the largest changes in iOS 9 is the capability to convert a previously installed app into an Intune managed app.  In previous versions of the iOS, organizations who wanted to use Microsoft’s family of managed apps could deploy them with Intune.  In most cases, users already had a popular Microsoft app installed.  In order for Intune to manage that, the user would have to un-install their personal version of the app and install an Intune managed version.  With the new iOS 9, this is not necessary as Intune will retroactively manage any previously installed Microsoft apps.

With user permission to take the management of an app over, Intune has this capability with iOS 9.  After the app is “converted”, the same Intune mobile app management (MAM) policies are in place instantly for the application and the data.  Users can now use a single productivity app for their personal use and work use while Intune only manages their work account through a multi-identity app management feature.

A new ChangeManagementState key is also new to the InstallApplication MDM command which is used by Intune to push apps.  This key can be set to “Managed” to allow Intune to display a prompt to convert the app.  iOS 8 and earlier versions won’t be affected by this.  This new feature in iOS 9 is available for all customers and will immediately take effect when you deploy an app to any iOS 9 device.

For the Enterprise

iOS 9 brings  several new configuration options for IT admins which are ready for enterprise use.  Some of the most noticeable changes are those to the MDM framework.  New support for Exchange ActiveSync v16 is enabled in native Calendar and Mail apps.  AirDrop is an unmanaged storage which helps to prevent potential data leakages.  The iCloud Photo Library can be disabled so sensitive photos aren’t accidently uploaded to a third party Cloud service.  New MDM restrictions hide the App Store icon, however, new apps and updates can still run in the background.

App Trust Flow

Heightened security for launching side-loaded apps as mentioned above was created for iOS 9 in reaction to increased threats of malicious apps.  After a device is upgraded to iOS 9, users will find that any apps they install from external sources to the App Store will be blocked from running.  This is all part of the Day Zero support to prevent attacks from happening.  Side-loaded apps must go through an app called Trust Flow which will divide the system settings and require a manual install and selection of “Trust” to the side-app publisher.  After the device recognizes the publisher as a trusted publisher, the current and future apps from that publisher will be allowed to install and run on the device.

Agile IT can help support your BYOD (bring your own device) initiatives by empowering people to work from the devices they choose while providing consistent access to, and protection of, corporate applications and data. To learn more about how Agile IT can support you, contact us today.  For a more comprehensive list of all the new features and settings available in the new iOS 9, take a look at Apple’s IT/enterprise resources by clicking here.