Device Classification for iOS - Netskope Technical Documentation

You can classify iOS devices based on these criteria:

Minimum OS version
Passcode required
Device not compromised
Device Tags

Create Device Classification Rule for Versions From 127.0.0 Or Later

Earlier, the Device Classification Rules webUI provided only the Match Any or Match All operators to choose between criteria in a Device Classification rule. With the release of version 127.0.0, Netskope extends the support for the usage of logical operators AND/OR between criteria in a Device Classification rule.

The logical operators work at three levels in a Device Classification Rule:

Apply logical operators globally across all Criteria Groups within a device classification rule.
Apply logical operators within a Criteria Group.

To create a device classification rule for ioS:

Go to Settings > Manage > Device Classification.
Select iOS on the New Device Classification dropdown list.
Follow these steps to classify your iOS device. Select options and enter the requested parameters.
- Rule Name: Enter a name for this classification rule.
- Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.
- Classification Criteria: In Add Criteria Group, select one of the following options:
  - OS: Select an OS version from the dropdown list or create a custom OS version.
  - Require Passcode: Passcode check is an API call that validates if the device has configured any unlock code. The check fails for devices with no unlock code. No parameters required.
  - Device Not Compromised: To check if the critical system files in iOS devices are compromised such as Jailbreaking or rooting. No parameters required.
  - Device Tags: To check if the configured Device Tags are present in the device. You can select up to five Device Tags.
    
    This is a Beta feature. Contact Netskope Support team or your Sales Representative to enable this feature for your tenant.
Click Add Criterion to add more than one device classification option. You cannot add the same option twice in a single Criteria Group. The selected options remain greyed-out in a Criteria Group.
After you complete adding all the required criteria in the first group, select the logical operator Match All (AND) or Match Any (OR) to compare the criteria in the Device Classification Rule.
Choose and add the required criteria in the second group along with the logical operator for that Criteria Group.
Choose the logical operator to match the various criteria added in each group.
When finished, click Save.

Create Device Classification Rule for Versions Prior to 127.0.0

Go to Settings > Manage > Device Classification and select iOS on the New Device Classification dropdown list, and then follow these steps to classify your iOS device. Select options and enter the requested parameters.

Rule Name: Enter a name for this classification rule.
Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.
Classification Criteria: Checks for All or Any of the criteria selected.
For Devices Installed with iOS Client (for NPA):
- Minimum OS Version: Select an OS version from the dropdown list or create a custom OS version.
- Require Passcode: Passcode check is an API call that validates if the device has configured any unlock code. The check fails for devices with no unlock code. No parameters required.
- Device Not Compromised: To check if the critical system files in iOS devices are compromised such as Jailbreaking or rooting. No parameters required.
When finished, click Save.

Configure a Real-time Protection Policy

After creating a device classification rule, you can use it in a Real-time Protection policy.

To use this Device Classification in a Real-time Protection policy, click Policies > Real-time Protection in the Netskope UI. Select an existing policy or click New Policy and choose a policy type.
For Source, select the Users for this policy, and then click Add Criteria to specify. If you created a Private Apps policy, for Access Method, select Client. Otherwise, you will need to click Add Criteria to add this Access Method.

Private Apps for iOS requires that the Access Method be set to Client.

Click Device Classification, and then select label from Custom Device Management and Managed or Unmanaged from Device Classification, based on the devices you just classified.
- Managed means the device is managed; the device posture information sent by the Client matches at least one of the device classification checks configured for that Client’s OS.
- Unmanaged means the device is unmanaged; the device posture information sent by the Client matches none of the device classification checks configured for that Client’s OS.
Click Add Criteria, select OS, and then select iOS. Click Add Criteria again, select Device Classification, and then select your iOS Device Classification rule.
Choose a Destination, like Private App Segments, and then select a destination.
Choose Profiles and Actions, like using the Allow Action for specified applications. Finish creating or updating this policy to establish this device classification in a policy.
When finished, click Save and then Apply Changes.
After the policy has been created, perform the process for which the policy was created. Next go to Skope IT > Application Events and click the magnifying icon for an event to open the Application Event Details panel. In the User section you’ll see a Device Classification field, which shows one of these device classifications.

Create Device Classification Rule for Versions From 127.0.0 Or Later

The logical operators work at three levels in a Device Classification Rule:

Apply logical operators globally across all Criteria Groups within a device classification rule.

Apply logical operators within a Criteria Group.

To create a device classification rule for ioS:

Go to Settings > Manage > Device Classification.

Select iOS on the New Device Classification dropdown list.

Follow these steps to classify your iOS device. Select options and enter the requested parameters.

Rule Name: Enter a name for this classification rule.
Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.
Classification Criteria: In Add Criteria Group, select one of the following options:
- OS: Select an OS version from the dropdown list or create a custom OS version.
- Require Passcode: Passcode check is an API call that validates if the device has configured any unlock code. The check fails for devices with no unlock code. No parameters required.
- Device Not Compromised: To check if the critical system files in iOS devices are compromised such as Jailbreaking or rooting. No parameters required.
- Device Tags: To check if the configured Device Tags are present in the device. You can select up to five Device Tags.
  
  This is a Beta feature. Contact Netskope Support team or your Sales Representative to enable this feature for your tenant.

Click Add Criterion to add more than one device classification option. You cannot add the same option twice in a single Criteria Group. The selected options remain greyed-out in a Criteria Group.

After you complete adding all the required criteria in the first group, select the logical operator Match All (AND) or Match Any (OR) to compare the criteria in the Device Classification Rule.

Choose and add the required criteria in the second group along with the logical operator for that Criteria Group.

Choose the logical operator to match the various criteria added in each group.

When finished, click Save.

Create Device Classification Rule for Versions Prior to 127.0.0

Rule Name: Enter a name for this classification rule.

Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.

Classification Criteria: Checks for All or Any of the criteria selected.

For Devices Installed with iOS Client (for NPA):

Minimum OS Version: Select an OS version from the dropdown list or create a custom OS version.
Require Passcode: Passcode check is an API call that validates if the device has configured any unlock code. The check fails for devices with no unlock code. No parameters required.
Device Not Compromised: To check if the critical system files in iOS devices are compromised such as Jailbreaking or rooting. No parameters required.

When finished, click Save.

Configure a Real-time Protection Policy

After creating a device classification rule, you can use it in a Real-time Protection policy.

To use this Device Classification in a Real-time Protection policy, click Policies > Real-time Protection in the Netskope UI. Select an existing policy or click New Policy and choose a policy type.

For Source, select the Users for this policy, and then click Add Criteria to specify. If you created a Private Apps policy, for Access Method, select Client. Otherwise, you will need to click Add Criteria to add this Access Method.

Private Apps for iOS requires that the Access Method be set to Client.

Click Device Classification, and then select label from Custom Device Management and Managed or Unmanaged from Device Classification, based on the devices you just classified.

Managed means the device is managed; the device posture information sent by the Client matches at least one of the device classification checks configured for that Client’s OS.
Unmanaged means the device is unmanaged; the device posture information sent by the Client matches none of the device classification checks configured for that Client’s OS.

Click Add Criteria, select OS, and then select iOS. Click Add Criteria again, select Device Classification, and then select your iOS Device Classification rule.

Choose a Destination, like Private App Segments, and then select a destination.

Choose Profiles and Actions, like using the Allow Action for specified applications. Finish creating or updating this policy to establish this device classification in a policy.

When finished, click Save and then Apply Changes.

After the policy has been created, perform the process for which the policy was created. Next go to Skope IT > Application Events and click the magnifying icon for an event to open the Application Event Details panel. In the User section you’ll see a Device Classification field, which shows one of these device classifications.