Compare IBM Security MaaS360 profile modes

In today's rapidly evolving digital landscape, managing and securing mobile devices has become a critical concern for enterprises of all sizes. As mobile technology becomes increasingly integral to business operations, ensuring that these devices are properly managed and secured is essential to protecting sensitive data and maintaining operational efficiency. IBM Security MaaS360, a leading mobile device management (MDM) solution, offers robust tools to help organizations achieve these goals.

One of the key features of MaaS360 is its ability to enrol devices in different modes, specifically Profile Owner and Device Owner. Each enrollment mode offers distinct advantages and capabilities tailored to various organizational needs and security requirements. Understanding the differences between these modes and their respective impacts on device management is crucial for IT administrators and decision-makers aiming to implement an effective MDM strategy.

Prerequisites for Profile Owner and Device Owner mode enrollment

To effectively enroll devices in either Profile Owner or Device Owner mode using MaaS360, there are several prerequisites and considerations that you need to address. By meeting these prerequisites, you can ensure a smooth and effective enrollment process, leveraging the full capabilities of MaaS360 to manage and secure their mobile devices in both Profile Owner and Device Owner modes.

• MaaS360 subscription: An active subscription to IBM MaaS360 with appropriate licensing for mobile device management features.
• Administrative access: Access to the MaaS360 admin portal with the necessary permissions to configure and manage device enrollments.
• Internet connectivity: Reliable internet connectivity for devices to communicate with the MaaS360 server during the enrollment process.

Device-specific prerequisites

• Supported devices: Ensure that the devices to be enrolled are supported by MaaS360 and can operate in the desired enrollment mode (Profile Owner or Device Owner).
• Operating system requirements:
  • Profile Owner mode: Typically applicable to Android 5.0 (Lollipop) and later.
  • Device Owner mode: Generally requires Android 6.0 (Marshmallow) and later. For iOS, refer to Apple's guidelines and MaaS360 documentation for specific requirements.
• Factory reset:
  • Device Owner mode: Devices often need to be factory reset before they can be enrolled in Device Owner mode. This ensures a clean state for the device to be fully managed.
  • Profile Owner mode: Does not usually require a factory reset, making it suitable for personal devices that are already in use.

MaaS360-specific prerequisites

• MaaS360 account configuration: Proper configuration of your MaaS360 account, including the setup of enrollment policies, compliance rules, and security settings.
• Enrollment tokens and credentials: Generate necessary enrollment tokens or credentials from the MaaS360 portal that will be used during the device enrollment process.
• Device Enrollment Program for iOS: If you are enrolling iOS devices, you can use Apple’s Device Enrollment Program (DEP) for streamlined and automated enrollment.

Security and compliance prerequisites

• Security policies: Define and configure security policies that will be applied to the devices upon enrollment, including password policies, encryption, and application restrictions.
• Compliance requirements: Ensure that the enrollment process adheres to organizational compliance requirements and any relevant regulatory standards.

Preparation and training

• IT staff training: Train your IT staff on the enrollment procedures, differences between Profile Owner and Device Owner modes, and troubleshooting common issues.
• User communication: Be sure to communicate the enrollment process and expectations to users, especially if their devices need to be factory reset or if they will be operating under different management policies.

Enrolling devices

In addition to the prerequisites, the following information and steps are required for enrolling devices in MaaS360, whether in Profile Owner or Device Owner mode:

Enrollment steps and procedures

• Enrollment methods: There are different methods available for enrolling devices, such as manual enrollment, QR code enrollment, NFC bump, or automated enrollment using zero-touch provisioning for Android or Apple Device enrollment Program (DEP) for iOS.
• Configuration profiles: Prepare configuration profiles that define the settings, restrictions, and policies to be applied to enrolled devices. These profiles should be tailored to the specific needs of your organization and the chosen enrollment mode.
• Device preparation: Ensure that devices are prepared according to the enrollment method. For Device Owner mode, this typically means performing a factory reset and initiating the enrollment during the initial device setup. For Profile Owner mode, existing devices might require certain setup steps to initiate the enrollment.

Policy and compliance settings

• Security policies: Define security policies that will be applied to the devices, including password complexity, screen lock settings, encryption requirements, and app installation restrictions.
• Compliance rules: Set up compliance rules to ensure devices adhere to organizational standards. These rules can trigger actions such as notifying the user, locking the device, or wiping the device if compliance is breached.

Enrollment overview

Choose your appropriate method to enroll in a specific MaaS360 mode and then verify that enrollment:

Manual enrollment

• Profile Owner mode: Navigate to the MaaS360 self-service portal or use an enrollment URL to initiate the process.
• Device Owner mode: During device setup, scan the provided QR code or use the NFC bump method to enrol the device in Device Owner mode.

Automated enrollment

• Zero-touch enrollment (Android): Use the zero-touch portal to configure devices to automatically enroll in MaaS360 upon first boot.
• Apple DEP (iOS): Configure devices in the Apple Business Manager or Apple School Manager to enroll automatically in MaaS360.

Verification and compliance check

• Verify that the device has successfully enrolled and that all policies and profiles have been applied correctly.
• Ensure the device is compliant with all security and compliance rules set in the MaaS360 portal.

Special considerations

Before you enroll your devices, review the following considerations to determine what makes sense for your organization.

BYOD vs. corporate-owned devices

Determine the appropriate enrollment mode based on whether the devices are personally owned ("bring your own device," or BYOD) or corporate-owned. Profile Owner mode is often more suitable for BYOD scenarios, while Device Owner mode is ideal for corporate-owned devices.

Privacy and data protection

Ensure that your enrollment practices comply with data protection regulations and respect user privacy, particularly in BYOD environments.

Application management

Decide on the applications that need to be pre-installed, blacklisted, or whitelisted on the devices. Use MaaS360’s app management capabilities to enforce these decisions.

By addressing these additional details, you can ensure a comprehensive and well-managed enrollment process for mobile devices using MaaS360, tailored to your organization's specific needs and compliance requirements.

Steps

Following are the high-level steps to enroll devices in MaaS360 for both Profile Owner and Device Owner modes.

Preparing for enrollment

Complete the following steps before you begin enrolling devices (applies to both Android and iOS):

1. Set up your MaaS360 account:
   1. Sign up for an IBM MaaS360 account if you don’t already have one.
   2. Log in to the MaaS360 Admin Portal.
2. Generate the enrollment token:
   1. In the MaaS360 Admin Portal, go to the Devices tab.
   2. Click Enrollments and generate an enrollment token or QR code. This will be used during the enrollment process.

Enrolling devices in Profile Owner mode (BYOD)

1. Prepare the device:
   1. Ensure the device meets the operating system requirements (Android 5.0 or later).
   2. Install the MaaS360 MDM for Android app from the Google Play Store.
2. Begin enrollment on the device:
   1. Open the MaaS360 MDM app.
   2. Enter the enrollment token or scan the QR code that you generated when you were preparing for enrollment (alternatively, the token or code might be provided by your administrator).
   3. Follow the prompts to install the necessary profiles and configure the device.
3. Complete the setup by accepting the prompts to grant the required permissions to MaaS360. The device will be enrolled, and the policies and configuration profiles will be applied automatically.

Enrolling devices in Device Owner mode (corporate-owned)

Complete the following steps to enroll your device in Device Owner mode:

Factory reset

Before enrolling an Android device, you need to perform a factory reset to ensure the device is in a clean state.

Note: Performing a factory reset on an Android phone can vary slightly depending on the device manufacturer and Android version. Here's a general guide that should work for most Android devices:

Method 1: Using the Settings menu

Before performing a factory reset, make sure to back up any important data, as this process will erase all data on your device.

1. Go to your phone's settings and tap System (this may also be listed under General Management on some devices).
2. Tap Reset options (or Backup & reset on some devices).
3. To perform a factory reset, tap Erase all data. Follow the on-screen instructions to confirm the reset. You might need to enter your PIN, pattern, or password. Note: Be sure you want to perform the factory reset. You will remove all personal data from the device.
4. Tap Reset (or Erase Everything). Your phone will restart and begin the factory reset process. This process can take a few minutes.

Method 2: Using Recovery mode

1. Power off your device completely.
2. Press and hold the Volume Up button and the Power button simultaneously (the key combination can vary depending on the device. For example, it might be Volume Down + Power, or Volume Up + Bixby + Power for Samsung devices).
3. Use the volume buttons to navigate and the power button to select. Select Wipe data/factory reset.
4. Use the volume buttons to highlight Yes and the power button to confirm.
5. After the reset is complete, restart the device. Your phone will restart and be restored to its factory settings. You can then set it up as a new device.

Additional tips

• Google account: Ensure you know your Google account details (email and password), as you will need to log in after the reset.
• Remove SD card: If you have an SD card, you might want to remove it before resetting to avoid any data loss from it.

QR code method

1. During the setup process, when you are prompted to set up the device, tap the screen six times (usually at the welcome screen) to enter the QR code setup mode. (See the video below for a demonstration of this procedure.)
2. Scan the QR code generated in the MaaS360 portal.

NFC method

You can use another Near Field Communication (NFC)-enabled device to enroll. NFC enables two devices to communicate when they are close to each other, typically within a few centimeters. In the context of MaaS360, you can use NFC to quickly transfer enrollment information from one device to another. The MaaS360 NFC enrollment app can bump the new device and transfer the enrollment information.

1. To ensure both devices have NFC enabled, go to Settings > Connections (or Wireless & Networks) > NFC, and toggle it on.
2. On the source device (the one that is already enrolled with MaaS360), ensure the MaaS360 NFC Enrollment app is installed and configured and then open the MaaS360 NFC Enrollment app. This app will prepare the enrollment information for transfer.
3. Turn on the new (target) device and proceed to the setup screen, where you are prompted to set up the device.
4. To initiate the NFC Transfer, hold the source device and the target device back-to-back. This is commonly referred to as bumping the devices.
5. Ensure the NFC areas (usually around the back center of the devices) are aligned and touching each other.
6. A prompt will appear on the source device asking if you want to transfer the information. Tap to confirm.

The target device will then receive the enrollment information. Follow any additional prompts to complete the setup on the target device.

Additional tips

During enrollment, use the following tips to help ensure success:

• Keep devices close: Make sure the devices stay in contact until the transfer is complete to avoid any interruptions.
• Follow on-screen instructions: Both devices might display instructions or prompts during the process. Make sure to follow these to ensure successful enrollment.
• Battery level: Ensure both devices have sufficient battery charge to complete the process without interruption.
• NFC not working: If the NFC transfer doesn't start, ensure both devices have NFC enabled and are in close contact.
• App issues: Ensure the MaaS360 NFC Enrollment app is up to date and properly configured on the source device.
• Device compatibility: Not all devices support NFC. Make sure both the source and target devices are NFC-enabled.

The device will automatically download and install the MaaS360 app. Follow the prompts to complete the device setup. The device will be enrolled in Device Owner mode, with full control and policies applied by MaaS360.

Enrolling iOS Devices

The following instructions take you through the process of enrolling an iOS device:

Enrollment using Apple Device Enrollment Program (DEP)

1. Prepare devices in Apple Business Manager:
   1. Log in to Apple Business Manager (ABM) or Apple School Manager (ASM).
   2. Add the devices to your ABM or ASM account and assign them to the MaaS360 MDM server.
2. Configure DEP in MaaS360:
   1. In the MaaS360 Admin Portal, go to the Setup.
   2. Select "Apple Device enrollment Program" and configure the settings, including default policies and profiles for enrolled devices.
3. Start the device. It will automatically contact the Apple DEP server and download the MaaS360 MDM profile.
4. Follow the prompts to complete the device setup and enrollment.

Manual enrollment (Non-DEP devices)

1. Ensure the device meets the iOS version requirements.
2. Download and install the MaaS360 app from the App Store.
3. Open the MaaS360 app and enter the enrollment token or URL provided by your administrator.
4. Follow the prompts to install the MDM profile and complete the enrollment.

By following these steps, you can effectively enroll devices in MaaS360, whether in Profile Owner or Device Owner mode, ensuring they are managed and secured according to your organization's policies.

Enrollment challenges

Enrolling devices in Profile Owner and Device Owner modes using MaaS360 can present several challenges:

Profile Owner mode

The following challenges are specific to the Profile Owner mode:

• User Resistance: Users might be hesitant to enroll their personal devices, fearing loss of privacy or control over their own data and apps.
• Limited Control: IT administrators have limited control over the device compared to Device Owner mode, which can make enforcing certain policies and restrictions more challenging.
• Compatibility issues: Not all devices and Android versions support Profile Owner mode, which can complicate the enrollment process for diverse device fleets.
• App Management: Managing and segregating work apps from personal apps can be complex, and ensuring seamless functionality of both sets of apps might require additional configuration.

Device Owner mode

The following challenges are specific to the Device Owner mode:

• Factory reset requirement: Enrolling a device in Device Owner mode typically requires a factory reset, which can lead to data loss if not properly backed up, and might cause inconvenience to users.
• Complex enrollment process: The initial setup process can be more complex, requiring methods such as QR code scanning or NFC bump, which might not be intuitive for all users.
• Device compatibility: Ensuring that all devices support Device Owner mode can be challenging, especially with a mix of older and newer devices in the organization.
• User training: Users might need additional training to understand the Device Owner mode and the implications of enrolling their devices, including changes to device functionality and access.
• Provisioning and setup: Zero-touch provisioning or Apple DEP setups need to be correctly configured, which requires careful planning and coordination, especially when dealing with a large number of devices.

General challenges

The following challenges can be encountered regardless of chosen mode:

• Technical issues: Network connectivity issues, software bugs, or server downtime can disrupt the enrollment process.
• Policy conflicts: Conflicts between organizational policies and device capabilities or user expectations can arise, necessitating careful policy design and communication.
• Support and troubleshooting: Providing adequate support and troubleshooting for diverse devices and issues encountered during enrollment can be resource-intensive.

By understanding and addressing these challenges, organizations can facilitate smoother enrollment processes and more effectively leverage MaaS360 for mobile device management.

Enrollment benefits

There are numerous benefits to enrolling your devices in MaaS360:

Profile Owner benefits

The following benefits are specific to Profile Owner mode:

• Separation of work and personal data: Profile Owner mode creates a work profile on the device, clearly separating work apps and data from personal ones, ensuring privacy for users.
• Improved security for BYOD: Provides a secure container for corporate data on personally owned devices (BYOD), reducing the risk of data leaks while maintaining user privacy.
• Easy management of work apps: IT administrators can manage, deploy, and update work apps independently of personal apps, ensuring that business-critical applications are always up-to-date and secure.
• Less intrusive: Less invasive for users compared to Device Owner mode, as it does not require a factory reset and maintains the user’s personal data and settings.
• Flexible use: Users can maintain their personal settings and apps while still complying with corporate security policies for work-related tasks.

Device Owner benefits

The following benefits are specific to Device Owner mode:

• Full device management: Provides IT administrators with full control over the device, allowing them to enforce comprehensive security policies and configurations.
• Enhanced security: Ideal for corporate-owned devices where security is paramount, as it enables stronger control over device encryption, remote wipe, and app restrictions.
• Streamlined setup: Devices can be pre-configured with necessary apps and settings before distribution, reducing setup time for users.
• Consistent user experience: Ensures a standardized setup across all managed devices, simplifying troubleshooting and support.
• Suitable for specific use cases: Perfect for use cases requiring high security and uniformity, such as in education, healthcare, and field services where devices need to be locked down and dedicated to specific tasks.

General benefits

The following benefits apply regardless of the chosen mode:

• Compliance and policy enforcement: Ensures devices comply with organizational policies and regulatory requirements, enhancing overall security and reducing compliance risks.
• Remote management: Enables IT administrators to manage and support devices remotely, including pushing updates, configuring settings, and troubleshooting issues.
• Data protection: Both modes support data protection mechanisms, such as encryption and remote wipe, to safeguard sensitive information.
• Productivity: Facilitates access to necessary apps and resources, improving employee productivity while maintaining security.

By leveraging the appropriate enrollment mode, organizations can effectively manage and secure their mobile devices, catering to both corporate-owned and BYOD scenarios.

After you enroll

After you've chosen the right mode and operating system for your organization and have finished enrolling your devices, complete the following tasks to ensure efficient operations:

• Verify enrollment: Check the MaaS360 Admin Portal to ensure the device appears under Devices and is marked as compliant.
• Apply additional configurations: Assign the device to the appropriate group based on department or role and then apply additional policies, profiles, or applications as needed.
• Monitor and manage: Use MaaS360’s monitoring tools to track the status, compliance, and security of the enrolled devices. You can set up alerts and reports to keep IT staff informed of any issues or non-compliance.
• Group devices and assignments: Group devices based on their roles, departments, or other criteria to streamline management and policy application.
• Monitor and report: Use MaaS360’s monitoring tools to track device status, compliance, and security incidents. Set up reports to provide regular updates to IT administrators and stakeholders.
• Implement user support and training: Provide support resources for users, including documentation on how to use their managed devices and how to troubleshoot common issues.

By following these steps, you'll be well-equipped to implement and manage device enrollments effectively, ensuring a secure and efficient mobile environment for your organization.

Demo video

The following video demonstrates the process of enrolling devices for use with MaaS360:

Video will open in new tab or window

Summary

This article has provided you with a comprehensive comparative analysis of the Profile Owner and Device Owner enrollment modes in MaaS360. By examining the unique characteristics, challenges, and benefits of each mode, you can equip your organization with the knowledge to optimize your mobile device management practices. You've seen the importance of selecting the appropriate enrollment mode to enhance security, streamline device management, and ultimately support your broader objectives of enterprise mobility.

Next steps

Now that you've learned about Profile Owner and Device Owner mode enrollment, take the next steps to continue your journey:

• Explore MaaS360: Visit the MaaS360 product page for comprehensive information on features, benefits, and deployment options.
• Join the community: Engage with other professionals in the IBM Security community. Share your experiences, ask questions, and gain insights from industry experts.
• Stay updated: Subscribe to the IBM Security Newsletter for the latest updates, tips, and resources on mobile device management and other security topics.
• Try it!: If you haven’t already, start a free trial of MaaS360 to experience the full capabilities of the platform.