You can create compliance policies that detect when users have blacklisted applications and configure these policies to resolve non-compliance.
For more information about the compliance engine, see the Mobile Device Management Guide, available on AirWatch Resources.
Example of Compliance Policy Actions
The compliance engine detects a user with an application blacklisted by an App Scan Integration Vendor. You can configure the compliance engine to take measures.
- Send a push notification to the user prompting them to remove the application.
- Remove certain features such as Wi-Fi, VPN, or email profiles from the device.
- Send an email notification to the user copying IT Security and HR.
Configure Compliance for App Scan
Build an application compliance policy to perform an action on devices with non-compliant applications:
Ensure that you are in the correct organization group.
- Navigate to Devices > Compliance Policies > List View. Select Add.
- Select the platform depending on the application reputation scanning service you use.
Select Application List on the Rules tab and select Contains Blacklist App(s) for integration.
If the engine detects applications listed in blacklisted app groups on devices assigned to the compliance rule, the engine performs the actions configured in the rule.
Move to the Actions tab to set escalating actions the engine performs.
Setting Description Mark as Not Compliant
Enable the check box to tag devices that violate this rule, but once the device is tagged non-compliant and depending on escalation actions, the system might block the device from accessing resources and might block admins from acting on the device.
Disable this option when you do not want to quarantine the device immediately.
Application Select to remove the managed application. Command Select to configure the system to command the device to check in to the console, to perform an enterprise wipe, or to change roaming settings. Select to block email on the non-compliant device. Notify
Select to notify the non-compliant device with an email, SMS, or push notification using your default template.
You can also send a note to the admin concerning the rule violation.
Profile Select to use AirWatch profiles to restrict functionality on the device.
Move to the Assignment tab to assign the compliance rule to smart groups.
Setting Description Managed By View or edit the organization group that manages and enforces the rule. Assigned Groups Type to add smart groups to which the rule applies. Exclusions Select Yes to exclude groups from the rule. View Device Assignment Select to view the devices affected by the rule.
- Move to the Summary tab to name the rule and give it a brief description.
Select Finish and Activate to enforce the newly created rule.