Welcome
Administrator Guide
Read this guide to learn about enrolling, administering, and troubleshooting endpoints through BigFix MCM and BigFix Mobile.
Geofencing
Geofencing is a location-based technology that creates a virtual boundary (or “zone”) around a real-world area using GPS, Wi-Fi, cellular data, or RFID signals.
Deploying Zone Settings to the MDM Server
Deploying zone settings allows the MDM administrator to enforce specific policies, restrictions, and configurations to devices within a defined geographic or logical area (a “zone”). Once deployed, the MDM server pushes these settings to all applicable devices automatically.

BigFix Documentation Homepage
Modern Client Management and BigFix Mobile
Welcome to the Modern Client Management and BigFix Mobile documentation, where you can find information about how to install, maintain, and use Modern Client Management and BigFix Mobile.
BigFix Mobile and MCM Overview
Discover how BigFix Mobile and Modern Client Management (MCM) extend unified endpoint management to mobile devices and modern OS platforms like iOS, Android, and Windows 10+, all from a single console.
Guides in PDF format
This section contains links to PDF versions of all the MCM and BigFix Mobile manuals.
Installing and Configuring BigFix Mobile and MCM
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
Deployment Guide
This document provides guidance for deploying the certificate enrollment infrastructure required for BigFix Mobile Configuration Management (MCM). It describes how to integrate BigFix MCM with Microsoft certificate services to enable device certificate enrollment using the Simple Certificate Enrollment Protocol (SCEP).
Quick Start
This quick start guide gets you up and running with your BigFix MCM and BigFix Mobile solution. It helps you secure, configure, and manage your mobile devices quickly and efficiently.
User Guide
Administrator Guide
Read this guide to learn about enrolling, administering, and troubleshooting endpoints through BigFix MCM and BigFix Mobile.
- Modern Client Management and BigFix Mobile
  This guide is intended for HCL BigFix Master Operators (MO) and those who administer BigFix deployments. If you are looking for information about using Modern Client Management (MCM) and BigFix Mobile, see the WebUI User's Guide.
- BigFix MCM
  Read this section to learn enrolling and managing Windows and macOS desktop and laptop devices.
- BigFix Mobile
  BigFix Mobilesimplifies the management and security of Android, iOS, and iPadOS devices, enabling IT admins to seamlessly enroll, configure, and monitor mobile devices, ensuring compliance and protection of corporate data.
- Feature configuration
  The Feature Configuration page in BigFix WebUI enables you to target specific MDM servers and deploy advanced feature modules to managed endpoints. After uprading to MCM v3.6 or later, use the Feature Configuration page to activate specialized management capabilities like Geofencing, Battery Health monitoring, Jailbreak detection, and Remote Access for your MDM servers.
- SCEP Certificate-based authentication
  BigFix MCM supports certificate-based authentication through Simple Certificate Enrollment Protocol (SCEP). SCEP is the fastest and most secure way to provision certificates to all your MCM-managed devices. With SCEP, IT Admins can automate issuing certificates to the endpoints to provide access to corporate Wi-Fi, VPN, and secure e-mail through encryption.
- SAML-authenticated enrolment flow
  When you configure SAML as the authentication method, when a user hits the enrollment URL and click Enroll, the user is first authenticated via the identity provider before proceeding with the enrollment process.
- Application management
  App Management in BigFix Mobile and MCM provides a centralized way to distribute, update, and control applications across multiple device platforms. Administrators can deploy both public store apps and internal corporate apps, enforce policies, and secure company data while simplifying the app lifecycle for end users.
- Battery health and level monitoring
  The Battery Health feature provides visibility and proactive monitoring of mobile device battery performance to improve device reliability and minimize user productivity disruption. Monitoring is event-driven and avoids continuous polling mechanisms.
- Email configuration management
  With BigFix MCM and BigFix Mobile, you have the ability to install and set up email application that can connect to your email system. This allows users to easily connect, verify their identity, and synchronize their work email accounts on their devices.
- VPN management
  BigFix MCM and BigFix Mobile enable organizations to manage and configure Virtual Private Network (VPN) settings on enrolled Android, Apple, and Windows devices, ensuring secure remote access to corporate networks.
- Wi-Fi configuration management
  BigFix MCM and BigFix Mobile offer WiFi configuration management, where administrators can control and configure the wireless network settings on MCM-enrolled devices. This helps organizations to maintain a secure and reliable wireless network infrastructure while providing flexibility for users to connect to authorized networks.
- Jailbreak Detection
  Jailbreak Detection enables administrators to identify compromised mobile devices enrolled in the MDM platform.
- Geofencing
  Geofencing is a location-based technology that creates a virtual boundary (or “zone”) around a real-world area using GPS, Wi-Fi, cellular data, or RFID signals.
  - Creating a Zone in WebUI
    You can create a Geofence Zone in BigFix Modern Client Management (MCM) WebUI to define a virtual boundary around a specific geographic area. When devices enter or exit this zone, MDM policies or actions associated with that zone can be triggered automatically.
  - Configuring Geofencing Settings in WebUI
    After creating a Geofence zone, you must configure Geofence Settings to define how devices behave when they enter or exit that zone.
  - Mapping a Zone to a Specific Setting
    After creating geofence zones and defining settings, the next step is to map a zone to a specific setting. This mapping links a physical location (zone) with the geofencing behavior (setting) — determining what policies or actions are triggered when a device enters or exits that zone.
  - Deploying Zone Settings to the MDM Server
    Deploying zone settings allows the MDM administrator to enforce specific policies, restrictions, and configurations to devices within a defined geographic or logical area (a “zone”). Once deployed, the MDM server pushes these settings to all applicable devices automatically.
  - Managing Policies with Geofencing
    Once geofence zones and settings are configured, administrators can apply policies that automatically take effect when a device enters or exits a defined geographic area. This enables location-based policy enforcement, improving both security and productivity.
  - Configuring Actions and Notifications
    Configure geofence actions and notifications to monitor device movement, trigger policies or actions, and send alerts when devices enter or exit defined zones.
  - Configuring Actions (for example, Wipe)
    Actions are commands you can trigger on managed devices through the WebUI. Common actions include Wipe, Lock, Passcode Reset, and App Installation. Configuring actions allows administrators to enforce security policies or manage devices remotely.
  - Target Devices for Geofencing Policies
    Before applying geofencing policies, you need to select the devices or device groups that the policy should affect. Targeting ensures that only relevant devices receive the configured restrictions or app policies based on their location.
  - Troubleshooting and Best Practices
  - Frequently Asked Questions (FAQ)
- Remote Access
  This procedure outlines the steps required to start a Remote Access session using Modern Client Management.
- BigFix MCM and Mobile Known Limitations
  This topic lists known limitations and restrictions in BigFix Modern Client Management (MCM) and BigFix Mobile for each version. Use this to understand feature gaps, known issues, or unsupported configurations relevant to your environment.
- Troubleshooting
  This section is intended to help you solve problems that might occur when installing BigFix MCM and BigFix Mobile.
- Frequently Asked Questions
  Read this section for commonly asked questions and their answers to manage the MCM deployments better.
Glossary
This glossary provides terms and definitions for the BigFix software and products.

Deploying Zone Settings to the MDM Server

Deploying zone settings allows the MDM administrator to enforce specific policies, restrictions, and configurations to devices within a defined geographic or logical area (a “zone”). Once deployed, the MDM server pushes these settings to all applicable devices automatically.

Step 1: Define or Configure a Zone:Creating a Zone in WebUI

Step 2: Configure Zone Settings: Configuring Geofencing Settings in WebUI

Go to Zone Settings / Policy Mapping.
Assign relevant configurations:
- Wi-Fi, VPN, or network policies
- App restrictions or allowed apps
- Device restrictions (camera, Bluetooth, screen capture)
Ensure these settings are linked to the correct zone.

Step 3: Associate Policies with the Zone

Navigate to Policies → Assign to Zone.
Select the desired policies (app, restriction, or device policies).
Link them to the zone you defined.

Step 4: Deploy to MDM Server

Once policies are linked:
1. Click Deploy / Push to MDM Server.
2. Confirm deployment.
The MDM server now registers the zone settings and schedules delivery to applicable devices.

Step 5: Device Behavior

Entering a Zone: Devices automatically receive and enforce the assigned policies.
Exiting a Zone: Policies may be reverted or updated based on your configuration (e.g., restore default settings).

Step 6: Verification

Check the Device Overview Dashboard or logs to ensure policies are applied.
Verify device compliance with the zone settings.

Key Notes

Only devices enrolled in the MDM server and within the defined zone receive the settings.

Always test zone deployment in a limited pilot group before wide-scale rollout.