IBM MaaS360

IBM MaaS360

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Agent Audit

    Posted 01/16/20 04:23 PM
    We are looking for the best way to verify that most/all clients in our production environment are enrolled/have the MaaS agent installed.   Just curious if anyone else has gone down this path and if so, what methods were used.  I'm sure there are clients in our environment that are not enrolled for one reason or another and we'd like to be able to put a list together. As we move forward with using MaaS to deploy software/updates etc, we'd like to know we aren't leaving holes or possible vulns out there.

    ------------------------------
    Kelly Fields
    ------------------------------


  • 2.  RE: Agent Audit

    Posted 01/16/20 04:39 PM

    Hi Kelly,

    I'll try to keep this as concise as possible, but we should really break it down in to two answers:  Those who are enrolled and those who have the app.

    Those who have the app is easy enough - a search can be created in the MaaS360 "Advanced Search" option under Devices to look for devices enrolled that do (or do not) have the MaaS360 application installed.

    Those who are enrolled is a bit more difficult, depending on the baseline you want to measure enrollment.  

    If that baseline is devices with email configured - if you are using Exchange/Office365, Traveler, or G Suite - MaaS360 can leverage our Cloud Extender and other tools to look for devices with mail configured and to block them if they are not enrolled.

    If mail isn't really the metric you want to go by, there are other options - Cloud Identity for Single Sign On (included in MaaS360) may be leveraged with certain products to ensure that devices using the service are enrolled in MaaS360.

    Likewise we also integrate with a number of network security products such as Cisco ISE to provide network access control - devices must be enrolled to join the network.

    Simple inventory control may provide the answer as well - if your company is providing the devices you can simply export the inventory of enrolled devices from MaaS360 as a spreadsheet and compare it to what your employees have been provisioned to look for discrepancies.

    There are different variations of the above that may work, so if you have any questions or would like clarification on any points above, feel free to ask



    ------------------------------
    Matt Shaver
    System Architect
    IBM
    mshaver@us.ibm.com
    ------------------------------