Configuring Imprivata Mobile Device Access

To configure device settings:

1. Go to the Access Management section.

2. (Optional) Select Allow guest mode.

   By default, users must authenticate to access the device. When enabled, users can tap Guest to access the device without having to authenticate. When a user access the device in this way, single sign–on is not available.

3. (Optional) Select Automatically log out a user.

   By default, a user's session remains active until the user logs out or a user switch occurs. You can specify a duration after which time the authenticated user is automatically logged out.

4. (Optional) Select Inactivity re-authentication.

   By default, a user's session remains active until the user logs out or a user switch occurs. You can specify a duration after which time the device is locked and the user is required to re–authenticate.

5. (Optional) By default, users authenticate using a proximity card. You can:

   • Add an Imprivata PIN or password as a second factor.

     Select Turn on grace period for second authentication factor, and specify the grace period.

     The grace period is the time during which subsequent authentications do not require the second factor.

   • Enable the policy for a username and password + an Imprivata PIN.

     Select Unlock with Imprivata PIN instead of proximity card, and specify the grace period.

     The grace period is the time during which subsequent authentications require an Imprivata PIN only.

     Use this setting when configuring Countdown to lock mode to renew a session using the Imprivata PIN.

By default, all open Google Chrome and Zebra Web browsers are closed when a user logs out or during a user switch.

To change the default web browser data settings:

1. Go to the Web Browser Management section.

2. (Optional) Enable one of the settings:

   • Do nothing

   • Force stop all browsers — Stops all related browser services.

   • Clear cache on all browsers — Clears all cached images and files.

   • Clear data on all browsers — Clears the cache and deletes all data associated with the browser.

By default, the Imprivata appliance does not check if user credentials have been changed outside of Imprivata OneSign (out of band). If a user has updated their password out of band, authentication fails.

When enabled, Imprivata MDA checks for an out of band password change before authentication:

• If detected, the user is prompted to reenter their credentials.

• After the user successfully authenticates, the new credentials are saved.

To check for an out of band password change:

1. Go to the Authentication section.

2. (Optional) Select Validate stored domain credentials before authenticating.

Customization settings let you:

• Change the language of end user messaging.

• Specify which push notifications are allowed to appear on the home screen.

  By default, Imprivata MDA blocks the push notifications from all apps from appearing on the home screen.

To configure customization settings:

1. Go to the Customization section.

2. (Optional) Select a language.

   • In Imprivata MDA 7.14 and later, the language is controlled by the device level localization settings, commonly configured in your MDM, and not by the mobile policy.

   • In Imprivata MDA 7.13.4 and earlier, in the Customization section, select a language.

3. (Optional) Select Allow lock screen notifications, and enter the package name for each application whose push notifications should be allowed.

   IMPORTANT:

   Notifications may contain sensitive information, such as PHI or private data, and can be read while the device is locked.

   Users can interact with notifications based on the following settings:

   • VoIP applications (no authentication required to answer call) — Users can answer or decline a voice call from the Imprivata MDA home screen.

   • VoIP applications — A notification appears on the home screen stating that there is an incoming call. Users must authenticate to the device to answer or decline the voice call.

   • Messaging & other applications — A notification appears on the home screen stating that there is a notification. Users must authenticate to the device to read it.

If you do not know the package name, you may be able to use its Imprivata MDA profile or its Google Play Store app URL to find it:

• While the profile for a partner app cannot be edited, others can be opened to view settings.

  To use an app profile to identify a package name, go to the OneSign single sign-on application profiles page, locate the required app, and click Edit profile.

• To identify the package name for a partner app, or any other third-party app on the device, you can use its Google Play Store app URL.

  From the Google Play Store, search for the app, and then open its page.

  The package name forms the end part of the URL after the "?id=".

  For example, https://play.google.com/store/apps/details?id=com.imprivata.Messaging

4. (Optional) Select Allow floating Home button. Applies to Workspace ONE Launcher configuration.