Set up MDM and in-app registration for Android devices

You can scale app delivery to a large number of mobile devices, secure content access, and manage data on mobile devices with Mobile Device Management (MDM). With admin setup in Splunk Secure Gateway and a compatible MDM provider, users can register and authenticate their devices directly in the Connected Experiences app with their Splunk credentials. Users won't need access to Splunk Secure Gateway.

MDM and in-app registration are currently available for the following Connected Experiences apps:

• Splunk Mobile for iOS
• Splunk Mobile for Android
• Splunk AR for iOS

Splunk AR for iOS

The Connected Experiences apps support MDM providers that are part of the AppConfig community. See https://www.appconfig.org/members/ to learn more about the different AppConfig member tiers. This includes, but isn't limited to, MobileIron, VMware AirWatch, IBM, and Citrix. Microsoft InTune isn't supported at this time.

See the AppConfig website for the iOS and Android standards and check with your MDM provider to see if they follow these standards:

• For iOS, see https://www.appconfig.org/ios/
• For Android, see https://www.appconfig.org/android/

To set up MDM and in-app registration for iOS, see Set up MDM and In-app registration for iOS devices.

To set up in-app registration and distribute a Connected Experiences mobile app using MDM, take the following steps:

1. Add a supported Connected Experiences app to your compatible MDM provider.
2. Generate or retrieve instance ID files from all of the Splunk platform instances that you want your mobile device users to have access to.
   If you're providing your users access to multiple instances, combine the instance ID files into a single instance ID file using the concatenation feature in Splunk Secure Gateway.
   
3. Add the contents of the instance ID file as a custom app configuration for the Connected Experiences mobile app in your MDM provider.

For more details about MDM features and how the in-app device registration process works, see About Mobile Device Management with Splunk Mobile.

Prerequisites

Complete the following prerequisites before you deploy a Connected Experiences mobile app with MDM and in-app registration:

• Have admin role access to your Splunk platform instances.
• Have access to add and configure apps in your MDM service.
• Get Splunk Secure Gateway on your Splunk platform instances.
• Have Connected Experiences app users.
• Confirm that your Secure Gateway ID is unique and easily identifiable. The Secure Gateway IDs represent Splunk platform instances that users can register to.
• Use local or SAML authentication. See Use MDM with SAML authentication.
• Use a supported MDM provider. MDM providers that are a part of the AppConfig community are supported.

Steps

Complete the following steps to deploy Splunk Mobile at scale using MDM and in-app registration.

Add Splunk Mobile for Android to your MDM provider

Add Splunk Mobile as a native public app from the Play Store. See your MDM provider documentation for instructions on how to add an app.

Generate or retrieve instance ID files

Get instance ID files from Splunk Secure Gateway on all of the Splunk platform instances that you want to register users to. If you've already generated an instance ID file, retrieve the existing instance ID file. If this is the first time you're getting an instance ID file, generate a new instance ID file. If you want to reset your MDM encryption and signing keys, renew the instance ID file.

Generating a new instance ID file overwrites the previous MDM signing key. Users who haven't registered using the previously deployed Splunk Mobile app can't register until they receive the new MDM signing key. You must recombine the instance ID files and upload the new combined file as a configuration to your MDM provider for users to register their devices.

If this is your first time getting an instance ID file, or if you want to renew your instance ID file, complete the following steps:

1. Log into the Splunk platform instance that you want to register users to.
2. Navigate to the Configure tab of Splunk Secure Gateway.
3. If you're getting an instance ID file for the first time, select Generate Instance ID File. If you're renewing an instance ID file, select Renew Instance ID File.

If you've already generated an instance ID file for this instance, complete the following steps to retrieve it:

1. Log into the Splunk platform instance that you want to register users to.
2. Navigate to the Configure tab of Splunk Secure Gateway.
3. Click Get Existing Instance ID File.

The instance ID file contains the instance's Splunk Secure Gateway public encryption and signing key, Secure Gateway ID, and MDM signing private key. The files allow the mobile client to identify your Splunk platform instance.

Combine instance ID files

If you're providing your users access to more than one Splunk platform instance, combine the instance ID files in Splunk Secure Gateway. If you're providing users access to just one instance, you can skip this step.

1. On any of the Splunk platform instances that you generated an instance ID file with, navigate to the Configure tab of Splunk Secure Gateway.
2. Upload all of the instance ID files.
3. Click Combine Instance ID Files.

Splunk Secure Gateway runs a script that combines the instance ID files into a single instance ID file.

Configure Splunk Mobile for in-app registration

Use a custom app configuration to add the mobile app to your AppConfig-compatible MDM service.

If you're using MobileIron, use the custom app configuration iOS Managed App Configuration.

If you're using another AppConfig MDM service, follow your provider's documentation to set a configuration for the mobile app.

After selecting a configuration for your situation, add the instance ID file information as a key-value pair. Use the following information to complete the key-value fields:

Field	Value
Key	server_config
Value	The contents of the single or combined instance ID file from Splunk Secure Gateway
Value Type	String

Distribute Splunk Mobile to your Android users

Follow your MDM provider's instructions to distribute the Splunk Mobile app to your users.

For user documentation on how to download the MDM-distributed Splunk Mobile app, see Download Splunk Mobile.

User registration

When a user launches the Connected Experiences app, they select from a list of Secure Gateway IDs that represent the Splunk platform instances that instance ID files are generated from. Mobile users can select a Secure Gateway ID and register to that instance using their Splunk credentials. See Use SAML authentication with Mobile Device Management (MDM) in the Use Splunk Secure Gateway manual for registration documentation.

(Optional) Use MDM with SAML authentication

u can use MDM with SAML authentication to secure your Connected Experiences app deployment. See Use SAML authentication with Mobile Device Management (MDM) for more information about using MDM with SAML authentication.