Shared Device Policy Creation and Device Restrictions

About this task

  • The "Shared Device" policy option is available in the policy creation menu if Azure ID is configured.
  • Authentication: Currently supports Microsoft Authenticator. Future support may include Ping Directory and Okta.
  • App Registration: Admins must register the BigFix Frontline app in their Azure portal using a specific redirect URI (a JKS key) provided by the developers.
  • MSAL Configuration: After registration, the MSAL configuration string from Azure must be pasted into the policy.

  1. Navigate to Apps > MCM > Policy and click Create Policy.

  2. Select Shared Device Policy.

  3. Configure the following key sections:

    • Authentication: Link your configured Identity Provider (e.g., Azure AD).

    • Data Cleanup: Enable to ensure all session data is wiped on logout.

    • App Entitlements: Assign apps to specific user groups.

    • Guest Mode: (Optional) Enable for temporary, unauthenticated access.

    • Shift Configuration: Set mandatory shift start/end times and idle timeouts.

  4. Click Save.

  1. The "Shared Device" policy option is available in the policy creation menu if Azure ID is configured.

    1. Authentication: Currently supports Microsoft Authenticator. Future support may include Ping Directory and Okta.

    2. App Registration: Admins must register the BigFix Frontline app in their Azure portal using a specific redirect URI (a JKS key) provided by the developers.

    3. MSAL Configuration: After registration, the MSAL configuration string from Azure must be pasted into the policy.

  2. Push dynamic security rules based on the user's group, such as disabling the clipboard, locking out camera/microphone access, tracking device location, and setting up automated logouts after a shift ends.

    1. Navigate to Apps > MCM > Policy.

    2. Click Create Policy and select Shared Device Policy.

    3. Configure the policy settings:

    Setting

    Description

    Policy Name

    Descriptive name (e.g., "Warehouse Shift Device Policy")

    OS

    Android

    Enrollment Type

    Dedicated Device

    Authentication Method

    Select your configured IdP

    Session Timeout

    (Optional) Auto-logout after idle time

    Data Cleanup on Logout

    Enable — clears app data, cache, files, SMS, call history, contacts, and session tokens

    Branding

    Attach the branding configuration created in Step 2

    1. Under App Entitlements, define which apps are available per user role/group.

    2. Under Device-Wide Baseline, configure policies that apply regardless of which user is signed in:

      • Password requirements

      • Network / Wi-Fi configuration

      • VPN settings

      • Kiosk launcher restrictions

    3. Click Save.

    Step 5: Create and Deploy a Policy Group

    1. Navigate to Apps > MCM > Policy Groups.

    2. Click Create Policy Group.

    3. Configure:

      • Policy Group Name: Descriptive name

      • OS: Android

      • Enrollment Type: Dedicated Device Enrollment only

      • Link Policy: Select the Shared Device Policy created in Step 4

    4. Click Save.

    5. Select the Policy Group and click Deploy to push it to enrolled shared devices.

    6. Verify deployment status in the policy group dashboard.

Procedure