Android App Deployment
The following describes how to deploy the Android App for use with Blocksi.
To sign up for TinyMDM
Sign in to the TinyMDM console with your Google Workspace account at the following URL: https://www.tinymdm.net/console/?locale=en#signup:default. The sign in window opens.
Click Sign up with Google.
Select your school's Admin Google Workspace account and sign in. The TinyMDM dashboard opens.
Go to Enterprise approved apps and click Register with Google Workspace. You are prompted for your account domain and an authorization token. See the next section for obtaining the token.
To get your token
Sign in to your Google Admin Console.
Click Devices.
Click Mobile & endpoints from the Main Menu to the left.
Click Third-party integrations.
Click the Android EMM section under Third-party integrations.
Click Add EMM providers. The Manage EMM providers screen appears.
If a token is present in the Token generator section, copy the token; otherwise, click Generate Token to create a new token and copy it. Go to the EMM provider's website (TinyMDM) and share the token. Your EMM provider will provide the remaining setup instructions. After the provider receives your token, the provider is listed in the table.
Close the Manage EMM providers screen to return to the Third-party integrations screen.
Select the Enable third-party Android mobile management checkbox and click Save. This enables the Third-party MDM. In our case, this is TinyMDM. We have now completed the school Admin account registration.
After signing up and registering our company, we can start with the configuration of our TinyMDM console.
To configure TinyMDM
Go to the TinyMDM console.
Navigate to Enterprise approved apps from the left menu pane to configure apps for our device. Under Apps management we can add or remove apps that we want to be used inside our organization.
Select the apps that are going to be approved company-wide: public, private, or web from the Enterprise approved app tab.
Note
All the selected apps are going to be approved company-wide, but you’ll be able to adapt the list depending on the policies you’re setting up.
For public apps, click the Browse apps button and authorize as many apps as you need.
For private apps, click the Private apps button and upload private apps, if needed (APK format).
Add the Blocksi Link app as a private app and click the Private apps button. Click OK at the confirmation prompt. The following screen appears.
Click the + icon in the lower right-hand corner. The following screen appears.
Type a name for the app that we are going to add to our organization. For example: Blocksi-link-app and upload the APK file of the app.
Click the Upload APK button and select the APK file to upload.
Click the Create button in the lower-right-hand corner. We have successfully added the app. Your private app should now be visible in your Enterprise Approved Apps list.
To update a private app, go to Enterprise approved apps > Private app and click the private app you need to update. Then, click Edit and upload the .apk file that includes the new version and wait a few minutes before pushing the update on managed devices through the security policy.
If you need assistance, please go to https://www.tinymdm.net/help-resources/quick-start/.
To create or import users
Before giving your students a managed device, you first have to register them via the Users and Groups tab.
You can create users in the following ways:
Use the Add user option and scan a QR to import one user at a time.
Use the Import users option by import a .csv file to add multiple users at once.
Note
We will not be using the Multiple enrollment option.
To add individual users
Click the Add user button. The following window opens.
Clear the Anonymous user and Send an email to the user checkboxes.
Type the email address of the student in the first field.
Type the full name of the user in the second field.
Click OK. We have successfully added a new user/student.
To import users from a .csv file, we need to have prepared. This file has the following structure: user_name;user_email;group_name;directory_name;is_anonymous;send_email;custom_field;
Note
The following is very important for our app: The group_name and custom_field fields need to be empty, and the is_anonymous and send_email fields need to contain a value of 0. For example, John Doe;john.doe@demo.com;;john.doe;0;0.
To add multiple users
Click the Import Users button. The following window opens.
If the upload is successful, the users are created and appear in the Users tab.
The policy represents the security rules that we want to apply to the mobile devices, such as password requirements, approved apps, kiosk mode, connectivity management (Wi-Fi, Bluetooth, NFC) etc.
To create a policy
Go to the Policies tab in the left menu pane.
Click Create a policy. The following screen appears.
Click the Without name text, and type a name the policy. In our case, let's name it Policy_test. We can also add a short description to the policy, but it is not necessary.
To add users to the policy
Select the checkbox next to the user's name or the group if several users belong to the same group.
To configure device security options
Disable fingerprint authentication.
Disable face recognition authentication.
Set the password requirements such as type/quality (letter/numeric/special characters, pattern, PIN) and minimum size. We recommend that the password quality is set to Only password or PIN or Only password or complex PIN.
To configure the apps management tab
Set the application permissions to Automatically granted.
Set the default update mode for apps to Always when wifi.
Approve apps that we want to be installed on our devices.
Click the icon of the app, or click the Settings button and click the Approve field. Policy approved apps are fully colored and their name appears in green, while unapproved apps are grayed out and their name appears in red.
To install the approved apps on all devices, click the Select all checkbox, and then click the Settings button and click Install selected apps.
To uninstall an app, click the Settings button next to the app to uninstall and click Uninstall from the drop-down menu.
If we want to lock our user's access to only a few available apps and disable some of the navigation buttons, we can enable Lock task mode, commonly known as Kiosk mode. For this mode to be correctly configured we need to do the following:
Select the Enable lock task mode checkbox and then click the Advanced lock task mode settings text to expand the list of checkboxes.
Select the Enable floating home button (all Android version) checkbox.
Select the Shake and quit checkbox.
Select the Disable Device switch off checkbox.
Approve the apps that we want to be enabled in kiosk mode. Refer to Steps 3 through 6 in Configuring the Apps Management Tab.
You can disable kiosk mode in the following ways:
Clear the Enable lock task mode checkbox on the TinyMDM console.
If we want to exit the mode from the tablet, we either shake the device and type in the admin code, or from the tablet, click the Exit kiosk app icon and type in the admin code when prompted. The admin code can be found next to the Enable lock task mode checkbox on the TinyMDM console.
If we click the Advanced app management text at the bottom of the Apps management tab, we can configure some additional settings.
It is important that we select the Block app installation from unknown sources and Block app uninstall checkboxes so that we prevent the tablet user (e.g., student) from uninstalling apps from their device. We can leave other options empty.
We can skip the configuring the Internet Filtering, Wifi configuration, and Connectivity management tabs and go to the Device-wide controls tab.
From this section, we can do the following:
Select when Android OS will be updated
Prevent user from adding or removing personal accounts (like Google account) on the device
Allow installation of all Play Store applications of added google accounts
Prevent factory reset (in advanced settings we can also prevent factory reset from physical buttons on devices)
Disable Google factory reset protection
Disable camera
Block access to location settings
Disable debugging mode
Disable USB files access
Currently for us the most important boxes to check are Prevent factory reset and Disable debugging mode.
Again, we can skip the configuration of the following three sections: Screen control, Shared Contacts, and Shared files.
After we have added our users and created a policy, we can continue with the user enrollment process.
To enroll a device
Factory reset our device by tapping six (6) times in a row anywhere on the first screen displayed at startup, (but six times in one spot), and waiting for a few seconds.
Note
Even if the first screen is often the one where the language selection is made, it may vary according to the manufacturer of the device. Whatever the first screen is, the important thing is to tap six times on the initial screen.
Next, the camera of the device opens: we have to scan the QR code for our user. We find the QR code on our TinyMDM console under the Users and Groups menu. Every user has a unique code.
Connect to a Wi-Fi network and follow the steps of the configuration wizard.
The device automatically downloads TinyMDM. Click Begin and accept the Terms of Use.
The configuration defined in the security policy is applied directly. Change the current password.
Change the length of screen timeout to the maximum value (30 minutes). On the device go to Settings > Display > Screen timeout.
To add the Blocksi link app
Add the Blocksi Link App as shown in Configuring TinyMDM.
Go to the TinyMDM Console.
Go to Policies and select our policy (in our example, Policy_test).
Go to the Apps management tab and click the Settings button in the Blocksi Link App section.
Click Configuration from the drop-down menu.
Type a name for our configuration for the app; for example, Configuration for email address.
Click the Save button.
After we have installed all apps, continue with configuring the Blocksi Link App.
To configure the app on the device
Open the app on first use.
Upon app start, we are prompted with the Allow permission screen. Here we first have to agree to the accessibility permissions (as shown in the screenshots below).
Next we have to agree to runtime permissions. The process is shown in the screenshots below.
