This article gives guidance about the new management policy related to University owned and provided assets, mobile devices included.

What is new

The nature of mobile devices makes them more vulnerable to theft and loss. This new requirement will enable the University to better track and manage all University owned and provided assets (mobiles and tablets included).

All mobile devices (iPhone, iPad, Android phones and tablets) brought and therefore owned by the University will be registered and managed in a Microsoft management system. Initially all new devices will be enrolled, existing devices will be enrolled later. 

At the present time there is no plan to allow the enrolment of personal devices. If you need a mobile device for University business, you will need to purchase one.

Impact

These changes will impact all staff purchasing or using mobile devices such as tablets or phones provided by or brought though the University.

Changes you will notice  

1. The University will set the device name. This action will make easier to identify it on our management systems.   
2. There is requirement to have a complex password set:
   
   1. For Android this requirement is set to be a complex numeric password with a minimum length of 6 characters. Setting the requirement to be a complex password will mean that repeated or consecutive numbers, for example “1111” or “1234”, are not allowed
   2. For Apple devices this will be a numeric password with a minimum length of 6 characters.
3. Office applications (for example: Outlook, Teams, Words, ...) will be installed during the setup of the device. These are considered essential to be able to use the device for University work. The process of enrolling any device will be complete when these are installed and ready for use. These Office applications are required software and you cannot uninstall them. 

List of University provided mobile computing device

Any mobile device supplied by the University, regardless of how it was purchased. This includes:  

• Android smartphones
• Android tablet devices 
• Apple iOS smartphones
• Apple iPad tablet devices  

---

Back to the top

 

Data accessible and not accessible by the University

Data accessible by the University

On enrolled devices the University has access to: 

• Owner details. This is the university username used to log onto the phone
• Device name, serial number, IMEI, model (for example, Google Pixel) and manufacturer (for example, Microsoft)  
• Operating system and version (for example: iOS 12.0.1) 
• App inventory and app names  
• Phone number 

Data not accessible by the University

The University does not and will not have access to: 

• Browsing history 
• Personal emails, documents, contacts, or calendar details
• Passwords 
• Photos 

The university is able to lock or reset the device remotely should it be lost or stolen.

Settings controlled by the University

Some settings are controlled by the university. These have been set to ensure that university devices meet the required security settings. 

All devices

The settings that are managed on university devices include:

• Screen lock time is set to two minutes. The screen will not lock if you are actively using the device.
• Devices must have a password set and this password will comply to required university complexity settings. 
• The device name will be set by the university during initial setup and cannot be changed.  This enables us to better manage and track university assets. 

Apple devices

The settings that are managed on university devices include:

• Require Touch ID or Face ID authentication for AutoFill of password or credit card information
• Block voice dialing while device is locked
• Block setting up new nearby devices from university owned one. 
• Force encrypted backup of device
• Block removal of system apps from device
• Block use of Siri while device is locked

Android devices

The settings that are managed on university devices include:

• Block adding of new users
• Block User removal
• Block Account changes

 

---

Back to the top

 

Setting up your new device

Are you using a new sim card?

If you have a new contract, or your current contract is being transferred to a new sim card, it can take up to 24 hours for this connection to become active so you may not have mobile data or signal straight away.

iOS (iPhone or iPad device)

1. Turn on the new device and follow the initial setup wizard. Select your preferred language, location and quick start options. 

 

2. Choose the wireless network you wish to connect to.

Please select Eduroam if you are based at the University. If you require support connecting your device to eduroam, please follow the article "How to connect your mobile device to eduroam". Once connected, the device should then activate - this action may take a few minutes. 

 

3. Continue the initial setup wizard as instructed on the device. The Data & Privacy screen will appear, please read through and select Continue. There is an option to learn more if you wish to do so. 

 

4. On the Apps & Data screen, please select the option which is relevant to your situation. If this is a brand-new device, please select Don't Transfer Apps & Data.  

 

5. Select Next on the Remote Management enrolment screen. This is to allow the University to manage the device you will be using, to ensure compliance with the relevant legislation and guidance. 

 

6. You will then be asked to sign into the phone through the Microsoft Company Portal application using your university email (username@soton.ac.uk – for example: ab1c24@soton.ac.uk) and password.

7. You may then be asked to confirm your identity using Multi-Factor Authentication (MFA).

 

8. Once the device has configured, you will be asked to setup Touch ID then to create a passcode. Touch ID is optional therefore skip this step if you wish to do so, but a passcode is required for the device.

You can change the required password strength by selecting the option 'Password Options'. The required password complexity will be a 6-character numeric password.

If you chose to set a password that meets the required password complexity now, you will not need to change it later in the setup of the device.  

 

9. Sign in with your Apple ID and password. If you do not have one, please:

1. Select 'Forgot password or don't have an Apple ID?'
2. Follow the on-screen steps to create one

If you do not want to sign in with an Apple ID, it is possible to skip this option. Signing in with an Apple ID is highly recommended, but not mandatory.

 

10. Please continue the final steps of the initial setup wizard. The steps will include: 

• Terms and Conditions – please read through and select Agree
• Keep Your iPhone Up to Date – please select Continue
• Location Services – please enable Location Services
• Siri – this is optional, set up if you wish to do so
• Screen Time - this is optional, set up if you wish to do so

 

11. The Apple setup wizard is now complete.

You may receive a prompt asking you to change your passcode if a suitably complex password was not set earlier in setup process. Please update your passcode and ensure it has 6 or more numbers.

On completing the device setup, the required Office applications and the Company Portal application will be installed on the device. You will need to sign into both Office and Company Portal with your university account to complete the setup of the device.

The Office and Company Portal applications are required on University equipment and cannot be deleted. If you delete them, they will be reinstalled automatically

---

Back to the top

 

Android (mobile or tablet devices)

Samsung Android devices (Both mobile and tablets)

Samsung devices are managed slightly differently to other Android devices. The initial setup procedure and screens will therefore look different, but ultimately all Android devices have the same settings applied and are managed as university devices.

1. Follow the initial setup screens to select your preferred language and location.

2. You will then be asked to agree to the privacy setting, you will need to accept the "End user licence", you do not need to agree to send diagnostics data to Samsung.

3. Choose the wireless network you wish to connect to. Please select Eduroam if you are setting up the device on a University site. For a device with a Sim card, you can use cellular data.

4. You will receive a warning that your device is protected by Knox Cloud Service. Please select OK to continue past this warning message.

5. Your device will then update and setup a Work and Personal profile. The setup wizard will then ask you to set up a work profile, select Agree.

5. Once you get a screen saying 'Welcome to Chrome' the setup will proceed as per step 6 in the instructions for Non-Samsung devices.

 

Non-Samsung Android devices (Both mobile and tablets)

1. Turn on the new device and click in the background space 5 times when the welcome screen appears. Please note you may be asked at this stage to select your preferred language - please select as appropriate.  

 

2. When the camera screen opens, scan the QR code you received with the new device. 

 

3. Choose the wireless network you wish to connect to.
If you are based at the University, please select eduroam. If you require support connecting your device to eduroam, please follow the article "How to connect your mobile device to eduroam". 

Select Connect.  

 

 

4. Once connected, the setup wizard will inform you that the device belongs to your organisation (the University), select the button Next. 

 

5. The setup wizard will then ask you to set up a work profile, select Agree.

It will then create a work profile for the device. The University will be able to manage the device through this work profile. 

     

 

6. The setup wizard will ask you to agree to the Google Terms and Conditions. Please read and agree by selecting Accept & Continue. 

 

7. Once the work profile has been created, a sign-in page will appear. Please:

1. You will then be asked to sign into the phone through the Microsoft Company Portal using your university email (username@soton.ac.uk – for example: ab1c24@soton.ac.uk) and password. You may then be asked to confirm your identity using Multi-Factor Authentication (MFA).
2. Select  the button Next. 

Please note: you may be asked to authenticate your sign-in here as part of the University's Multi-Factor Authentication process.  

 

8. The screen will then display Your work checklist where you will need to firstly set up a screen lock. Please select Set up and set up a password for the device. 

 

 

9. Once the screen lock has been activated, you will need to install work apps for the device. 

Please select Install to install applications such as Microsoft Authenticator and Intune Company Portal, the University management gateway. Additional apps may be included in this process in the future.  

 

 

10. Once the work apps have been installed, you will need to register your device on the Intune Company Portal app. Please select  the link Set up. 

 

11. The Microsoft Company Portal application will appear, please select the button Sign in. 

 

12. As part of the sign in process, the device will ask for your University password. Please:

1. Enter your password
   and
2. Select the button "Sign in". 

 

13. The app will then ask you to register the device, please select the button Register.  

 

14. The device is now registered with iSolutions. Please follow the rest of the Android setup wizard at this stage as there will be further options to select (for example, setting up a Google account, device backup options). These options are personal choice and will not affect the devices complicance with University policies.

Once this is complete, your device will begin to install any required apps and settings. You will see several notifications and installations taking place whilst the device completes its setup, therefore please do not turn off the device for at least 1 hour. 

You will now need to check the device compliance. Please refer to Checking compliance on your computing device. 

 

Important notes

• To access the different profiles (work and personal) you will need to swipe up from the bottom of the device screen and then select the relevant profile.
• The Office applications that you need are installed under the 'Work' profile. You will need to sign into these applications with your University account to active the relevant Office application.  

---

Back to the top 

 

Registering your existing computing device  

iOS (iPhone or iPad device)

Before starting

You will need to install a specific application to register the device and allow iSolutions to manage the compliance.  

Please note: this process will only work on devices supplied by the University, and therefore registered automatically on our systems as owned by the University.  

You will need to contact iSolutions to ensure the device is correctly enrolled in our management system before starting this process.  

If you currently use your personal device or a device provided by another service, you will need to order a new device.  

Step-by-step instructions

1. On the iPhone/iPad home screen, open the App Store. 

 

2. Click on the Search tool, type 'Intune Company Portal' and install the app.  

 

3. Open the Intune Company Portal app on your device and when prompted select the button Sign In. 

 

4. Log into the application using your University username followed by @soton.ac.uk (for example: ab1c23@soton.ac.uk) and password. Select Next. 

 

5. The setup wizard will inform you of the notification settings. Select the button OK

 

6. The setup wizard will then instruct you to set up your University of Southampton access. Select Begin.

 

 

7. The setup wizard will detail what the University can and cannot access when managing the device.

Further details on what the University can and cannot access is provided in the article "Cyber Security Essentials" under the question "What information does the University have access to once the device is enrolled?".

Select the button Continue.

 

 

8. A small prompt will appear asking you to allow a website to download a configuration profile. Select Allow.  

Once the profile has downloaded, another prompt will appear confirming this. Select Close. 

 

9. The next step will be to install the profile you have just downloaded. Follow the next step on the setup wizard and select the button Continue.

 

 

10. As instructed on the setup wizard screen, minimise the application and go to: 

1. Settings 
2. General 
3. VPN & Device Management
4. Select Management Profile 
5. Select Install  

     

 

11. You will then be asked to confirm the passcode currently set on the device:

1. Enter the passcode
2. Select Done 
3. Select Install

 

 

12. The setup is now complete, and your device has been registered. You may receive a prompt asking you to change your passcode.

Please update your passcode and ensure it has 6 or more characters including letters, a number and an uppercase character. 

   

---

Back to the top 

 

Android (mobile or tablet devices)

Before starting

You will need to install a specific application to register the device and allow iSolutions to manage the compliance.  

Please note: this process will only work on devices supplied by the University, and therefore registered automatically on our systems as owned by the University.  

If you currently use your personal device or a device provided by another service, you will need to order a new device.  

Step-by-step instructions

1. On the Android smartphone/tablet home screen, open Play Store. 

 

2. Click on the Search tool, type 'Intune Company Portal' and install the app. 

 

 

3. Open the Intune Company Portal app on your device and when prompted select the button Sign In. 

 

4. Log into the application using your University username followed by @soton.ac.uk (for example: ab1c23@soton.ac.uk) and password.  

Select Next once you have entered your username, then select Sign In once you have submitted your password. 

 

 

5. The setup wizard will then instruct you to set up your University of Southampton access. Select Begin. 

 

6. The setup wizard will detail what the University can and cannot access when managing the device.

Further details on what the University can and cannot access is provided in the article "Cyber Security Essentials" under the question "What information does the University have access to once the device is enrolled?".

Select Continue.

 

7. The setup wizard will inform you of the permissions required by iSolutions. This will include: 

1. Allow permission to make and manage phone calls. iSolutions need to register the device's serial number and a cellular antenna ID to interact with the device to keep it secure. Please note: iSolutions and the Intune Company Portal app cannot make phone calls. 
2. Activate Android device administrator. This option allows iSolutions to apply required settings to the device. 
3. Confirm KNOX privacy notice. If you have a Samsung device, you will need to accept an additional privacy notice. 

Please click Next. 

 

8. The Intune Company Portal requires additional controls to help support compliancy, and to ensure the device can be securely erased should it be lost or stolen. It will list what actions are enabled once activated.

This includes: 

1. Delete all data. Erase the phone's data without warning by performing a factory data reset
2. Change the screen lock
3. Set password rules. Control the length and the characters allowed in screen lock passwords and PINs
4. Monitor screen unlock attempts. Monitor the number of incorrect passwords typed when unlocking the screen and lock the phone or erase all the phone's data if too many incorrect passwords are typed
5. Lock the screen. Control how and when the screen locks
6. Set screen lock password expiry. Change how frequently the screen lock password, PIN or pattern must be changed
7. Set storage encryption. Require that stored app data be encrypted
8. Disable cameras. Prevent use of all device cameras
9. Disable some screen lock features. Prevent use of some screen lock features. 

Please select the button Activate.  

The application will begin the process of registering the device. This may take several minutes. 

---

Back to the top

 

Related content

Cyber Security Essentials

Reporting a lost or stolen device