Reference Architecture — Standard Workflows for iOS

The Imprivata Mobile Access Management Reference Architecture helps create standardized deployments by providing clear guidelines for customers – selecting compatible components and deploying standard configurations that have been certified by our QE process. This ensures that all parts work together seamlessly with the MAM solution, reducing errors and inconsistencies, and ultimately leading to more reliable and efficient deployments.

This guide demonstrates how to build Workflows and Automations that adhere to Imprivata’s best practices.

Download a PDF of the guide.

Prerequisites

Use the Organize feature in the Workflows tab to create folders for the Workflows you will create throughout this guide.

  • Checkout Workflows

  • Device Setup and Update Workflows

  • Utility Workflows

  • Deprecated Workflows

  • Custom Workflows

Create new Launchpad Attributes in the Admin tab to use in the Workflows you will create throughout this guide.

  • Department

  • Facility

  • Launchpad Manager

  • Timezone

Building Standard Workflows

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: iOS Provisioning.

  3. Description: Prepare an iOS device with standard configuration for use with MAM.

  4. Select the Workflow Model: Device Enrollment Program.

  1. Click Add an action > Perform MDM Command.

  2. Select Clear Passcode.

  3. Assign DEP Profile: Specify your DEP profile.

  1. Click Add an action > Erase.

  2. Select Erase supervised and DEP devices.

  1. Click Add an action > Set Timezone.

  2. Timezone: [Timezone].

    Common US Timezones

    Timezone Value
    Eastern Time America/New_York
    Central Time America/Chicago
    Mountain Time America/Denver
    Pacific Time America/Los_Angeles
    IMPORTANT:

    Set the timezone to where the mobile device will be used.

    Locate the closest city, copy and paste the exact value listed into the Launchpad Attribute.

  1. Click Add an action > Add WiFi.

  2. Network Name (SSID): Set to *your provisioning network*.

  3. Security: Select WPA/WPA2 Personal or WPA/WPA2 Enterprise.

  4. MAC address: Select Disable randomization.

  5. Expiration: Set to Automatically forget after 60 minutes.

IMPORTANT:

The network used for provisioning should be a temporary network that the device connects to for setup only. Networks with CAPTCHA portals are not supported. Once enrolled into the MDM, devices should transition to the production network via an MDM deployed profile.

To ensure a smooth transition, the provisioning network and production network should not share the same SSID.

Ensure all ports and IPs are allowed on both networks.

  1. Click Add an action > Set Language and Locale

  2. Language: Specify your language.

  3. Locale: Specify your locale.

  1. Click Add an action > Set Wallpaper.

  2. Select an image: [Upload].

  3. For Lock Screen Text & Color, set the text to:

    If found, return this device to [Department].
    [Device Serial]
NOTE:

Optionally, use MAM to apply a wallpaper to the lock and home screens of the device.

You can also apply a wallpaper using your MDM. A key advantage of using MAM is the ability to apply useful information to the device wallpaper using Attributes.

Setting a wallpaper on check out is not supported.

  1. Click Add an action > Advanced > Set Attribute.

  2. Set Device Home to [Department].

NOTE:

When provisioning devices in bulk, a CSV can also be used to set this attribute.

Alternatively, if devices are being provisioned in a central location like a staging area, the Department attribute must be updated on the Launchpad to reflect the location where the devices will be placed.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Check In

  3. Description: Check in an iOS device.

  4. Select the Workflow Model: Device Enrollment Program.

  1. Click Add an action > Perform MDM Command.

  2. Select Clear Passcode.

  1. Click Add an action > Check In Device.

  2. Select Launch a blank page before Check In (for iOS 17 and below).

    NOTE:

    If the fleet of devices using Check Out are running iOS 18 or higher, deselect Launch a blank page before Check In.

  3. Logout Actions: Enable for each app that supports App Logout.

  4. Select Epic Rover, if used in your organization.

  1. Click Add an action > Advanced > On Failure.

  2. Click Retry this workflow.

  3. Maximum attempts: 2.

  1. Navigate to Automation > New Rule.

  2. Name: Check In

  3. Description: Check in an iOS device.

  4. Set a new trigger When a device is: Checked in.

  5. Deploy these workflows: Check In

  6. Enable Rule: ON

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Express Checkout.

  3. Description: Check out an iOS device using Express Checkout.

  4. Select the Workflow Model: iOS Express Checkout.

  1. Click Add an action > Check Out Device

  2. Text to display when unlocked: [Imprivata Display Name].

  1. Navigate to Automation > New Rule.

  2. Name: Express Checkout.

  3. Description: Check out an iOS device using Express Checkout.

  4. Set a new trigger:

    1. When a device is: Checked out.

    2. Then deploy these workflows: Express Checkout.

  5. Enable Rule: ON.

IMPORTANT:

Checkout Workflows should default to Express Checkout for an optimal user experience, except in cases where it does not support required functionality.

If you are unsure if your Workflow is supported, contact Imprivata Product Management team at mobile@imprivata.com.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Checkout.

  3. Description: Check out an iOS device using Checkout.

  4. Select Workflow Model: Device Enrollment Program.

  1. Click Add an action > Check Out Device.

  2. Text to display when unlocked: [Imprivata Display Name].

  1. Click Add an action > Advanced > Add Dynamic Config Profile.

  2. Profile Name: *your profile name*.

  3. Profile XML: *your profile code*.

NOTE:

Dynamic Config Profiles streamline the login experience to apps like WebEx. For more information on integrating with WebEx, see the MAM documentation.

  1. Click Add an action > Advanced > On Failure.

  2. Select Reboot and Check In.

NOTE:

If you are creating a new Checkout Workflow in MAM 7.0 or later, the On Failure action is automatically added to the Workflow and Reboot and Check In is selected by default.

  1. Navigate to Automation > New Rule.

  2. Name: Checkout.

  3. Description: Check out an iOS device using Checkout.

  4. Set a new trigger:

    1. When a device is: Checked out.

    2. Then deploy these workflows: Checkout.

  5. Enable Rule: ON.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Manual Checkout.

  3. Description: Check out an iOS device using a username and password.

  4. Select the Workflow Model: Over the Air.

  1. Click Add an action > Advanced > Set Attribute.

  2. Set Device User to [Device User].

NOTE:

The device user is already set, making this step redundant, but the purpose of this is to make checkout visible in the Activity log for a complete journey of the device.

If omitted, manual checkouts will only be seen in the Audit log.

  1. Navigate to Automation > New Rule.

  2. Name: Manual Checkout.

  3. Description: Check out an iOS device using a username and password.

  4. Set a new trigger:

    1. When a device is: Unlocked via Network Username and Password

    2. Then deploy these workflows: Manual Checkout

  5. Enable Rule: ON.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Incorrect Device Home.

  3. Description: Send an email when a device has been returned to the incorrect location.

  4. Select the Workflow Model: Over the Air.

  1. Click Add an action > Advanced > Send Email.

  2. Tab: Before Deployment.

  3. Addresses: [Launchpad Manager].

  4. Subject: Mobile device ([Device Serial]) returned to the incorrect location.

  5. Body: 

    Device [Device Serial] has been returned to the incorrect location.
    The device was last seen at [Launchpad Name] in port [Last Port Number].
    This device should be returned to [Device Home].

  1. Navigate to Automation > New Rule.

  2. Name: Incorrect Device Home.

  3. Description: Send an email when a device has been returned to the incorrect location.

  4. Set a new trigger:

    1. When a device is: Checked In.

    2. Add an optional condition: Device Home Is not [Department].

    3. Then deploy these workflows: Incorrect Device Home, Check In.

  5. Enable Rule: ON.

  6. Navigate to Automation.

  7. In the When devices are checked in section, use the menu icon to reorder the Incorrect Device Home automation rule to be the first rule in the list.

NOTE:

This section provides guidance on configuring Automation Rules to support iOS updates. The date and time in the automation schedule are provided as examples only.

When scheduling individual automation rules, coordinate with administration to ensure they align with their operations.

Avoid scheduling during shift changes or periods with limited support availability.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Update iOS.

  3. Description: Update an iOS device using standard settings.

  4. Select the Workflow Model: Device Enrollment Program.

  1. Click Add an action > Update iOS.

  2. Click Use the standard settings.

    Long iOS Update Delay: Install the oldest signed version.

  1. Navigate to Automation > New Rule.

  2. Name: Update iOS Ports 1-5.

  3. Description: Update iOS devices on ports 1-5.

  4. Set a new schedule for ports 1 through 5:

    1. On this date: 1/7/25 | At this time: 06:00 AM | Repeats: Daily.

    2. Add an optional condition:

      1. Device Checkout Status Is: Checked In.

      2. Device Battery Level: Greater than 50.

      3. Port Number: Less than or equal to 5.

      4. Deploy these workflows:

        1. Update iOS.

        2. Check In.

    3. Enable Rule: OFF.

  5. Navigate to Automation > New Rule.

  6. Name: Update iOS Ports Ports 6-10.

  7. Description: Update iOS devices on ports 6-10.

  8. Set a new schedule for ports 6 through 10:

    1. On this date: 1/7/25 | At this time: 12:00 PM | Repeats: Daily

      1. Add an optional condition:

        1. Device Checkout Status Is: Checked In.

        2. Device Battery Level: Greater than 50.

        3. Port Number: Greater than or equal to 6.

        4. Port Number: Less than or equal to 10.

        5. Deploy these workflows:

          1. Update iOS.

          2. Check In.

      2. Enable Rule: OFF.

  9. Navigate to Automation > New Rule.

  10. Name: Update iOS Ports 11-15.

  11. Description: Update iOS devices on ports 11-15.

  12. Set a new schedule for ports 11 through 15:

    1. On this date: 1/7/25 | At this time: 06:00 PM | Repeats: Daily

    2. Add an optional condition:

      1. Device Checkout Status Is: Checked In.

      2. Device Battery Level: Greater than 50.

      3. Port Number: Greater than or equal to 11.

      4. Port Number: Less than or equal to 15.

      5. Deploy these workflows:

        1. Update iOS.

        2. Check In.

    3. Enable Rule: OFF.

  13. Navigate to Automation > New Rule.

  14. Name: Update iOS Ports 16-20.

  15. Description: Update iOS devices on ports 16-20.

  16. Set a new schedule for ports 16 through 205:

    1. On this date: 1/7/25 | At this time: 12:00 AM | Repeats: Daily

    2. Add an optional condition:

      1. Device Checkout Status Is: Checked In.

      2. Device Battery Level: Greater than 50.

      3. Port Number: Greater than or equal to 16.

      4. Port Number: Less than or equal to 24.

      5. Deploy these workflows:

        1. Update iOS.

        2. Check In.

      6. Enable Rule: OFF.

Configure the following actions in your Workflow:

  1. Navigate to Workflows > New Workflow.

  2. Name: Set Device Home.

  3. Description: Manually set the Device Home based on the value in the Department Launchpad Attribute.

  4. Select the Workflow Model: Device Enrollment Program.

  1. Click Add an action > Advanced > Set Attribute.

  2. Set Device Home to [Department].

Organizing the Workflows

Use the Organize feature in the Workflows tab to move the workflows you created into the following folders:

  • Checkout Workflows

    • Check In

    • Express Checkout

    • Checkout

    • Manual Checkout

  • Device Setup & Update Workflows

    • iOS Provisioning

    • Update iOS

  • Utility Workflows

    • Set Device Home

    • Incorrect Device Home

  • Deprecated Workflows

    • (empty)

  • Custom Workflows

NOTE:

New workflows (or standard workflows that have been cloned) should reside in the Custom Workflows folder. Consider default folders to be read-only.