Welcome
Administrator Guide
Read this guide to learn about enrolling, administering, and troubleshooting endpoints through BigFix MCM and BigFix Mobile.
BigFix Mobile
BigFix Mobilesimplifies the management and security of Android, iOS, and iPadOS devices, enabling IT admins to seamlessly enroll, configure, and monitor mobile devices, ensuring compliance and protection of corporate data.
Lost mode
Lost Mode is a security feature in BigFix Modern Client Management (MCM) that enables IT administrators to remotely secure company-owned mobile devices that have been lost or misplaced. When activated, Lost Mode locks the device, blocks access to all applications, displays custom recovery information on the lock screen, and can play an alert sound — helping organizations protect corporate data and facilitate device recovery.
Enable lost mode
Use this procedure when an MDM-enrolled Android, iOS, or iPadOS device is reported missing or stolen. Enabling Lost Mode locks the device immediately and displays your custom instructions on the screen.

BigFix Documentation Homepage
Modern Client Management and BigFix Mobile
Welcome to the Modern Client Management and BigFix Mobile documentation, where you can find information about how to install, maintain, and use Modern Client Management and BigFix Mobile.
BigFix Mobile and MCM Overview
Discover how BigFix Mobile and Modern Client Management (MCM) extend unified endpoint management to mobile devices and modern OS platforms like iOS, Android, and Windows 10+, all from a single console.
Guides in PDF format
This section contains links to PDF versions of all the MCM and BigFix Mobile manuals.
Installing and Configuring BigFix Mobile and MCM
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
Deployment Guide
This document provides guidance for deploying the certificate enrollment infrastructure required for BigFix Mobile Configuration Management (MCM). It describes how to integrate BigFix MCM with Microsoft certificate services to enable device certificate enrollment using the Simple Certificate Enrollment Protocol (SCEP).
How-to guide
This section provides step-by-step instructions for setting up a BigFix environment, focusing on integration with third-party prerequisites such as Apple Business Manager and Google Play. It guides users through the necessary configuration steps to ensure seamless interoperability with these external services.
Quick Start
This quick start guide gets you up and running with your BigFix MCM and BigFix Mobile solution. It helps you secure, configure, and manage your mobile devices quickly and efficiently.
User Guide
Administrator Guide
Read this guide to learn about enrolling, administering, and troubleshooting endpoints through BigFix MCM and BigFix Mobile.
- Modern Client Management and BigFix Mobile
  This guide is intended for HCL BigFix Master Operators (MO) and those who administer BigFix deployments. If you are looking for information about using Modern Client Management (MCM) and BigFix Mobile, see the WebUI User's Guide.
- BigFix MCM
  Read this section to learn enrolling and managing Windows and macOS desktop and laptop devices.
- BigFix Mobile
  BigFix Mobilesimplifies the management and security of Android, iOS, and iPadOS devices, enabling IT admins to seamlessly enroll, configure, and monitor mobile devices, ensuring compliance and protection of corporate data.
  - Android mobile management
    BigFix Mobile, the Enterprise Mobility Management (EMM) solution, is integrated with Android Enterprise. With this solution, you can effortlessly enroll and manage Android devices.
  - Apple mobile management
    With BigFix Mobile, you can seamlessly enroll iOS and iPadOS devices.
  - ChromeOS management
    Chrome OS support in BigFix Mobile and Modern Client Management enables organizations to centrally manage enterprise ChromeOS devices using the same unified endpoint management framework used for other supported platforms. Through integration with Google Workspace (Chrome Enterprise), administrators can securely enroll Chrome OS devices, apply policies, perform remote actions, and monitor device health from the BigFix WebUI.
  - Device trust
    The Device Trust feature from BigFix Mobile prevents unmanaged devices from accessing enterprise services. It provides an extra layer of security to your organization's application access and protects against potential threats from compromised devices. This extra security helps ensure that your users access applications from a device that you know is trusted.
  - Kiosk management
    In kiosk mode, you can lock a device, so that it can run only one or a small set of applications. This mode turns an Android or Apple phone or tablet into a dedicated device that can run only one or more specified apps. Kiosk mode provides effective control over the device use and helps ensure that the devices can be used only for intended purposes. Mobile devices can run tasks in kiosk mode by configuring the settings through a policy. This feature applies only for company owned devices. In a dedicated or supervised device, the device user can access only the apps that the kiosk policy allows.
  - OS update
    The OS update policy allows to configure rules and settings to manage the operating system updates on the enrolled devices. This policy ensures that devices receive the necessary updates for security, bug fixes, and feature enhancements, while also maintaining a consistent and secure environment for all devices within the organization. The system update policy impacts both the current and future updates for the device, including any pending system update.
  - Lost mode
    Lost Mode is a security feature in BigFix Modern Client Management (MCM) that enables IT administrators to remotely secure company-owned mobile devices that have been lost or misplaced. When activated, Lost Mode locks the device, blocks access to all applications, displays custom recovery information on the lock screen, and can play an alert sound — helping organizations protect corporate data and facilitate device recovery.
    - Enable lost mode
      Use this procedure when an MDM-enrolled Android, iOS, or iPadOS device is reported missing or stolen. Enabling Lost Mode locks the device immediately and displays your custom instructions on the screen.
    - Manage Lost Mode
      Manage Lost Mode lets you perform recovery actions on devices that have already been reported as lost. You can disable Lost Mode when a device is recovered, remotely wipe its data if it is compromised, or play a sound (on supported iOS/iPadOS devices) to help locate it.
- Feature configuration
  The Feature Configuration page in BigFix WebUI enables you to target specific MDM servers and deploy advanced feature modules to managed endpoints. After uprading to MCM v3.6 or later, use the Feature Configuration page to activate specialized management capabilities like Geofencing, Battery Health monitoring, Jailbreak detection, and Remote Access for your MDM servers.
- SCEP Certificate-based authentication
  BigFix MCM supports certificate-based authentication through Simple Certificate Enrollment Protocol (SCEP). SCEP is the fastest and most secure way to provision certificates to all your MCM-managed devices. With SCEP, IT Admins can automate issuing certificates to the endpoints to provide access to corporate Wi-Fi, VPN, and secure e-mail through encryption.
- SAML-authenticated enrolment flow
  When you configure SAML as the authentication method, when a user hits the enrollment URL and click Enroll, the user is first authenticated via the identity provider before proceeding with the enrollment process.
- Application management
  App Management in BigFix Mobile and MCM provides a centralized way to distribute, update, and control applications across multiple device platforms. Administrators can deploy both public store apps and internal corporate apps, enforce policies, and secure company data while simplifying the app lifecycle for end users.
- Battery health and level monitoring
  The Battery Health feature provides visibility and proactive monitoring of mobile device battery performance to improve device reliability and minimize user productivity disruption. Monitoring is event-driven and avoids continuous polling mechanisms.
- Email configuration management
  With BigFix MCM and BigFix Mobile, you have the ability to install and set up email application that can connect to your email system. This allows users to easily connect, verify their identity, and synchronize their work email accounts on their devices.
- VPN management
  BigFix MCM and BigFix Mobile enable organizations to manage and configure Virtual Private Network (VPN) settings on enrolled Android, Apple, and Windows devices, ensuring secure remote access to corporate networks.
- Wi-Fi configuration management
  BigFix MCM and BigFix Mobile offer WiFi configuration management, where administrators can control and configure the wireless network settings on MCM-enrolled devices. This helps organizations to maintain a secure and reliable wireless network infrastructure while providing flexibility for users to connect to authorized networks.
- Jailbreak Detection
  Jailbreak Detection enables administrators to identify compromised mobile devices enrolled in the MDM platform.
- Geofencing
  Geofencing is a location-based technology that creates a virtual boundary (or “zone”) around a real-world area using GPS, Wi-Fi, cellular data, or RFID signals.
- Remote Access
  This procedure outlines the steps required to start a Remote Access session using Modern Client Management.
- Web content filter
  The Web Content Filter feature provides administrators with the ability to manage and secure the web browsing experience on managed devices. By implementing URL-based policies, organizations can ensure that users access only approved content, reducing the risk of data exposure and increasing productivity.
- Shared device management
  Shared Device Management allows organizations to securely deploy a pool of shared devices to frontline, shift, or kiosk workers. Instead of assigning a permanent, distinct device to every individual user, organizations can maintain a flexible pool of shared, corporate-owned devices. This approach reduces hardware costs while ensuring that every employee receives a secure and personalized workspace during their shift.
- BigFix MCM and Mobile Known Limitations
  This topic lists known limitations and restrictions in BigFix Modern Client Management (MCM) and BigFix Mobile for each version. Use this to understand feature gaps, known issues, or unsupported configurations relevant to your environment.
- Troubleshooting
  This section is intended to help you solve problems that might occur when installing BigFix MCM and BigFix Mobile.
- Frequently Asked Questions
  Read this section for commonly asked questions and their answers to manage the MCM deployments better.
- Support
  For more information about this product, see the following resources:
- Notices
Glossary
This glossary provides terms and definitions for the BigFix software and products.

Enable lost mode

Use this procedure when an MDM-enrolled Android, iOS, or iPadOS device is reported missing or stolen. Enabling Lost Mode locks the device immediately and displays your custom instructions on the screen.

About this task

Procedure

In the BigFix WebUI, navigate to Apps > MCM > Actions.
Under Actions , select Lost Mode.
Under Lost Mode Operation, select Enable Lost Mode.
Click Edit Devices to add or update your target device and review the Target Devices section.
Note: Only eligible devices are displayed.
- Supervised (iOS/iPadOS) or fully managed (Android) company-owned devices
- Devices not currently in Lost Mode

Fill out the Lost Mode Configuration fields to customize what appears on the lost device's screen:

Lost Message (Required): Provide clear instructions for the finder (e.g., "This device belongs to an organization and has been reported lost. If found, please contact the owner using the details below.").
Phone Number (Required): Enter a callback number where the finder can reach you or your IT department.
Email Address (Optional): Enter a contact email address.
Organization (Optional): Enter your company or organization name.
Address (Optional): Enter a physical return address if applicable.


Field	Android Limit	Apple (iOS/iPadOS) Limit
Lost Message(Required)	150 characters	150 characters
Phone Number(Required)	6–15 characters	6–15 characters
Organization Name	50 characters	Not Applicable
Address	150 characters	Not Applicable
Footnote Message	Not Applicable	65 characters
Contact Email Address	45 characters	Not Applicable

Review all files and click Send Command at the bottom of the page to deploy the lock screen and secure the device.
Note:
- If you need to abort the setup before sending the command, click Cancel to discard your changes and return to the previous screen.
- If the device is currently offline, the command is securely queued and will run automatically the moment it connects to a network.