SOTI MobiControl

A profile primarily serves as a container for applying device settings and applications to your device. To learn more, view Profiles. It is possible to create multiple profiles and assign them to different devices and device groups. To learn more, view Add Profiles.

To create a SOTI MobiControl profile:

1. In the Soti MobiControl console, from the left-pane select Profiles.

   

2. In Profiles, click Add Profile.

   

3. In Add Profile, select the desired Android enrollment mode under the Create new tab. This document proceeds with the Android > Work Managed profile.

   

4. In Create Profile, click the General tab and enter the following:

   • Profile Name: Enter the profile name. For example, Netskope Profile 

   • Description: Add some details to describe this profile.

   

5. Click Save.

Using profile configurations, you can add the required configurations and assign them to your device settings. To learn more, view Profile Configurations. In this document, Netskope adds profile configurations for Certificates, Authentication, and Feature Control.

To add profile configurations:

1. In SOTI MobiControl, navigate to Profiles.

2. In Profiles, click Add Profiles.

3. Choose an existing profile name and click Edit.

4. In the Edit Profile screen, perform the instructions in the following sections:

Add Certificates

Certificates is a security profile configuration mainly used to install Netskope root and intermediate certificates in your device.

To add Netskope root and intermediate certificates:

1. Click the Configurations tab.

2. Click + to add new Profile Configuration.

   

3.  In Add profile configuration, select Security > Certificates.

   

4. In Certificates, browse and import the root and intermediate Netskope certificates. To upload the Netskope root certificate, click the button to the right of the Certificate field. 

5. Browse and upload the root certificate.

6. Click Import.

7. Repeat the same procedure to upload the Netskope Intermediate Certificate.

   Ensure to enable Netskope Root and Intermediate certificates in the profile.

   

   

8. Click Save.

   The Configurations tab displays the newly added certificate details

 Add Authentication Policy

SOTI MobiControl requires an Authentication policy to push certificates. Add authentication policies to set a username and password for your device. To learn more, view Authentication.

To add an authentication policy:

1. Click the Configurations tab.

2. Click + to add new Profile Configuration.

3. In Add profile configuration, click Security > Authentication.

   

4. Under the Administrator tab, set a Password (required).

   

   Other options are optional and not related to Netskope deployment.

5. Click Save.

   The profile configuration section displays the newly added authentication profile details.

Configure VPN Settings

The Netskope deployment requires a VPN configuration associated with the Netskope Client. Configure VPN settings using the Feature Control option in Restrictions. To learn more, view Feature Control.

To add VPN settings:

1. Click the Configurations tab.

2. Click + to add new Profile Configuration.

3. In Add profile configuration, click Restrictions > Feature Control.

   

4. On the Security tab, set Always-On VPN to com.netskope.netskopeclient.

   Enable Block Connections Without VPN if  there are lockdown deployments where fail close capabilities are required.

   

5. Click Save.

Save and Assign

Once you add the required profile configurations, click Save and Assign the profile to the required user or device group.

In this section, you can refer to the instructions to choose and distribute Netskope Client application for your users. The distribution is mainly done through the app policies in SOTI MobiControl. To learn more, view App Policies.

To add an app policy:

1. In SOTI MobiControl, from the left-pane, click Policies.

2. In Policies, click Apps > New App Policy.

   

3. In Create App Policy, select Android > Android Enterprise.  

4. In the General tab, provide the policy name.

5. In the Apps tab, click Apps > Add New.

6. In Select Apps, perform the following:

   1. Select  Managed Google Play in App Source. 

   2. In the Apps section, search and locate Netskope Client.

   3. Click the three dots next to the Netskope Client app and click Configure.

      

   4. In Advanced Configurations, click Installation Options and choose the following:

      • Deployment Type: Mandatory

      • Priority: High Priority

      • Launch App After Installation: Toggle to enable this option.

        

   5. Click  Managed App Config under Configuration Options.

   6. Toggle to enable the option Enable Managed App Config and  enter the following values:

      Use the following app configuration for UPN enrollment.

      • User Email Address

        • If a user identity is bound to the device in Soti, set the value to %ENROLLEDUSER_EMAIL%.

        • If a service account is used for Netskope enrollment, configure it as a Custom Attribute, set the value to %CustomAttr:NETSKOPE% or another custom attribute name.

      • host: addon-<tenant>.goskope.com

      • token: ORG-ID token value

      • ns_mdm_check: Managed config token value (if configured)

      • enrollencryptiontoken: Secure enrollment encryption token value (if configured)

      • enrollauthtoken: Secure enrollment auth token value (if configured)

        Refer to Netskope Deployment Options to identify values needed for deployment.

   7. Click Save.

7. Click Add to close the Select App window.

8. Click Save and Assign.

9. In Assign, select the appropriate group for assignment.

10. Click Assign.

Custom attributes are typically required when you enroll devices without user affinity. In such cases, Netskope service accounts map to device groups in Soti MobiControl and follow business logic, such as store or office numbers.

Create a Custom Attribute

This section describes how to create a custom attribute in SOTI MobiControl.

To create a custom attribute:

1. In the SOTI MobiControl, select Global Settings > Device Settings.

2. Select Custom Attributes under Device Settings.

3. In Custom Attributes, click + to add a new attribute.

   

4. In the Add Custom Attributes window, configure the following:

   • Name: NETSKOPE

   • Data Type: Text

   • Data Type: Text

   

5. Click Save.

6. Navigate to Devices > select the relevant device group.

7. Right-click  and select Advanced Configuration.

   

8. In the Group Details tab, select Edit, and enter the value of the custom attribute for the device group.

   

   The service account must be provisioned in Netskope.