IBM Security MaaS360

Hi all

Basic app management concepts
Key to best practice for apps in MaaS360 are 2 basic concepts:
1. Apps are Managed - have been added to MaaS360 App Catalog. This becomes crucial for MaaS360 apps for iOS and also for Android where devices are enrolling into Android Enterprise.
2.  Apps are Distributed - 'pushed' to devices. Some of our customers like their users to self-serve where users can go in and pick their own apps. However for key apps (such as the MaaS360 apps) these should always be distributed to devices. 

Setting up for success
Next comes the way to ensure that as much as possible,  you are setting up the apps for successful installation on devices. 
You will find 2 checkboxes on an app in the MaaS360 App Catalog: "Install Automatically" (previously 'Instant Install') and "Update Automatically". 
Depending on the device type and enrollment type, this may actually be able to ensure the app gets installed 'silently' meaning that the user doesn't need to do anything. 
Please remember that these boxes should be checked when adding app to Catalog.
Why? Because if you go back in and check the boxes, and you have already distributed the apps, the impact will only occur when distributing to further / individual devices (no impact on existing distributions).

The check-boxes weren't checked, what happens if I check them now? 
- If you check the "Install automatically" and "Update automatically" box prior to distribution (before pushing to devices), the process is more likely to 'kick off' quickly and depending on the device/enrollment type, install silently (without requiring user acceptance). Again this is not across the board but these checkboxes do help. 
- If you check the boxes having already distributed the apps, they do not take effect for existing distributions, only for new ones. If you decided to remove distributions and/or app from App Catalog please take care about having checked the boxes for "Remove automatically on..." which may trigger uninstallation of app from devices!

Verify whether 'silent' installation is possible
Here are a few pointers regarding the device and enrollment types that can help to ensure apps get installed 'silently'. This happens only if the "Install Automatically" and/or "Update Automatically" checkboxes have been checked prior to distribution, and the device matches one of the criteria below. 
- On iOS devices, Supervised mode devices (enrolled through DEP) should be able to install and update apps without requiring user acceptance, provided the checkboxes above are checked. If enrolled in 'Normal' mode, the user will just get a pop-up inviting them to perform the installation.
Is your iOS device Supervised? Please open  your device from your MaaS360 portal (Devices > Inventory > individual device), from the Summary drop-down on top-left go down to Security & Compliance tab. In the first section (3rd line) the field "Supervised Device" should be set to 'Yes'. 
- On Android devices, for Device Admin mode (non-Android Enterprise), only non-Google Play apps will install and only on Samsung devices. Anything else requires users to accept installation, even if you have checked the boxes (may appear in notification area at top of screen). Where devices are enrolled in Profile Owner or Device Owner mode (Android Enterprise), the apps will install without user intervention (both Play Store and non-Play Store apps). 
Is your device is enrolled into Android Enterprise? Please open a device in your portal (Devices > Inventory > individual device), on the 1st page (Summary), in the 1st section there is a field "Container Type". If set to 'Profile Owner' or 'Device Owner' then your device is enrolled into Android Enterprise.
Please note: you cannot change these fields as they depend on how the device was initially set up. 

After you distribute app to devices: track installation / update status
Once you have pushed or distributed apps to devices, you can track the progress of installation. Please remember that due to the number of updates needing to be performed, the possible need for user to accept installation, the time taken to download and install app and so on, - there are multiple factors impacting the potential success of a distribution. There are 3 locations where you can verify app install and update status. 
a. From the App Catalog (on portal)
Within the app record you will have a number showing beside 'Distributed' and a number showing beside 'Installed'. This is what they mean: 
- Number of distributions: the number of individual devices to which the apps have been pushed (distributed)
- Number installed: the number of individual devices where the individual devices have completed the installation, and have sent an update back to portal to confirm. 
If you click into the blue text for the number installed, it will give you a breakdown of the individual devices to which the app has been pushed, and the status for each. This will update over time. 
b. From device (on the device itself)
Both Android and iOS devices have a 'check for updates' option which a user can perform to proactively verify whether updates (such as new app installs or upgrades) are available: 
- Android - in the MaaS360 app there is a Settings option, and inside this page there is an icon on top-right with 3 dots, tapping on this gives a number of options including "Update Device Data". 
- iOS - in the MaaS360 app there is a Settings option, inside of which there is a circular arrow top-right, allowing the device to verify whether any new updates are pending. 
c. From device (on portal)
Once the device receives (and installs) the app or update, it will send a signal back to the MaaS360 portal that the app has been successfully installed. 
Now, on the portal, on the device record, there are 2 tabs of interest: 
- Apps Installed - gives individual apps and numerical version (so you can check whether up to date). This depends on device having successfully installed update and sent back update to the portal. Please note that if you have enabled privacy settings in Security > Privacy menu, restricting app inventory, then only those apps which are Managed and Distributed will show in this list. If you want to check whether a specific app update has installed, this is the page you should look at. 
- App Distributions - shows the list of apps pushed (distributed) to the device, either from individual (device-specific) or group-level distributions. This page is better to use if you have a distribution pending and you just want to confirm that the individual device is expecting to receive it. 

How do I make sure that a maximum number of devices receive app installs and updates? 
- First, you need to ensure that a number of factors are true which will best ensure success: device is powered on, has a data connection, has sufficient storage space, MaaS360 app installed (from portal = managed/distributed), and where necessary the user has refreshed the device as in the last section. 
- Second, you can use "Allow list" and "Block list" in your App compliance settings (Security > Policies > Device policy > App Compliance) to ensure that the apps that should be on a device are on a device. Just get the App ID and paste it in, separating multiple values with a comma. This has the effect of forcing the device to ensure that the app gets installed and updated wherever possible.
- Third, using the App Compliance measures just mentioned, ensures that a device will now go out-of-compliance based on the app not being present. This shows individual devices on the Summary page as being out of compliance, and in addition  you can use Alerts on the Home page, and Compliance Rules to identify non-compliance and where possible alert and/or take corrective action.
- Finally, you can set up a Device Group to identify those devices which have not yet had the app or update installed. You can use the following search criteria (Devices > Advanced Search) and on this basis create a group. See screenshot attached. 

What is a reasonable expectation for app installation?
Based on experience I would say you could look for 80-90% of app installs and updates within 24-48 hours. 
This is a world-real statistic which depends on a number of factors - which can all be helped by taking the measures above. 
If you are finding that your apps are still not updating/installing, even after taking all the measures above, I suggest you contact our Support team to report an issue. 


Documentation
- Deploying apps to devices: https://www.ibm.com/docs/en/maas360?topic=overview-deploying-apps-devices
- Editing an existing app in App Catalog: https://www.ibm.com/docs/en/maas360?topic=overview-editing-app-in-details-view