MDX policies for third-party apps for iOS
This article describes the MDX policies for third-party iOS apps. You can change policy settings directly in the policy XML files or in the Citrix Endpoint Management console when you add an app.
If On, a PIN or passcode is required to unlock the device when it starts or resumes after a period of inactivity. A device passcode is required to encrypt app data using Apple file encryption. Data for all apps on the device are encrypted. Default value is Off.
If On, a PIN or passcode is required to unlock the app when it starts or resumes after a period of inactivity. Default value is On.
To configure the inactivity timer for all apps, set the INACTIVITY_TIMER value in minutes in Client Properties on the Settings tab. The default inactivity timer value is 60 minutes. To disable the inactivity timer, so that a PIN or passcode prompt appears only when the app starts, set the value to zero.
If you select Secure offline for the Encryption keys policy, this policy is automatically enabled.
Online Session Required
Maximum offline period (hours)
Defines the maximum period an app can run without reconfirming app entitlement and refreshing policies from Citrix Endpoint Management. At expiration, logon to the server may be triggered if needed. Default value is 168 hours (7 days). Minimum period is 1 hour.
Alternate Citrix Gateway
This policy name in the Endpoint Management console is Alternate NetScaler Gateway.
Address of a specific alternate Citrix Gateway that should be used for authentication and for micro VPN sessions with this app. This is an optional policy that, when used in conjunction with the Online session required policy, forces apps to reauthenticate to the specific gateway. Such gateways would typically have different (higher assurance) authentication requirements and traffic management policies. If left empty, the server’s default gateway is always used. Default value is empty.
Block jailbroken or rooted
If On, the app is locked when the device is jailbroken or rooted. If Off, the app can run even if the device is jailbroken or rooted. Default value is On.
If On, the app is locked when the device is not connected to a Wi-Fi network. If Off, the app can run if the device has an active connection, such as a 4G/3G, LAN, or Wi-Fi connection. Default value is Off.
Allowed Wi-Fi Networks
Comma-delimited list of Wi-Fi networks. If the network name contains any non-alphanumeric characters (including commas), the name must be enclosed in double-quotes. The app will run only if connected to one of the networks listed. If blank, all networks are allowed. This does not affect connections to cellular networks. Default value is blank.
App update grace period (hours)
Defines the grace period that an app can continue to be used after the system has discovered that an app update is available. Default value is 168 hours (7 days).
Using a value of zero is not recommended since it immediately prevents a running app from being used until the update is downloaded and installed (without any warning to the user). This might lead to a situation where the user is forced to exit the app (potentially losing work) in order to comply with the required update.
Erase app data on lock
Erases data and resets the app when the app is locked. If Off, app data is not erased when the app is locked. Default value is Off.
An app can be locked for any of the following reasons:
- Loss of app entitlement for the user
- App subscription removed
- Account removed
- Secure Hub uninstalled
- Too many app authentication failures
- Jailbroken device detected (per policy setting)
- Device placed in locked state by other administrative action
Active poll period (minutes)
When an app starts, the MDX Framework polls Citrix Endpoint Management to determine current app and device status. Assuming the server running Endpoint Management can be reached, the framework returns information about the lock/erase status of the device and the enable/disable status of the app. Whether the server can be reached or not, a subsequent poll is scheduled based on the active poll period interval. After the period expires, a new poll is again attempted. Default value is 60 minutes (1 hour).
Only set this value lower for high-risk apps or performance may be affected.
If Off, the data stored on the device is not encrypted. If On, the data stored on the device is encrypted. Default value is On.
If you change this policy after deploying an app, users must reinstall the app.
Database encryption exclusions
Exclusion list of databases that are not automatic encrypted. To prevent database encryption for a specific database, add an entry to this comma-separated list of regular expressions. If a database path name matches any of the regular expressions, the database is excluded from encryption. The exclusion patterns support Posix 1003.2 Extended Regular Expressions syntax. The pattern matching is case-insensitive.
\.db$,\.sqlite$ will exclude any database path name that ends with either “.db” or “.sqlite”.
\/Database\/unencrypteddb\.db will match database unencrypteddb.db in the Database subfolder.
\/Database\/ will match all databases that contain /Database/ in its path.
Default value is empty.
File encryption exclusions
Exclusion list of files that are not automatically encrypted. To prevent encryption for a specific set of files, add an entry to this comma-separated list of regular expressions. If a file path name matches any of the regular expressions, then that file is excluded from encryption. The exclusion patterns support Posix 1003.2 Extended Regular Expressions syntax. The pattern matching is case-insensitive.
\.log$,\.dat$ excludes any file path name that ends with either “.log” or “.dat”.
\/Documents\/unencrypteddoc\.txt matches the contents of the file unencrypteddoc.txt in the Documents subfolder.
\/Documents\/UnencryptedDocs\/.*\.txt matches “.txt” files under the subpath /Documents/UnencryptedDocs/.
Default value is empty.
Leave this field blank if you want all mobile apps managed by Endpoint Management to exchange information with one another. Define a security group name to manage security settings for specific sets of apps (for example, Finance or Human Resources).
To apply this policy to an existing app, users must delete and reinstall the app.
Cut and Copy
Blocks, permits, or restricts Clipboard cut and copy operations for this app. If Restricted, the copied Clipboard data is placed in a private Clipboard that is only available to MDX apps. Default value is Restricted.
Blocks, permits, or restricts Clipboard paste operations for this app. If Restricted, the pasted Clipboard data is sourced from a private Clipboard that is only available to MDX apps. Default value is Unrestricted.
Document exchange (Open In)
Blocks, permits, or restricts document exchange operations for this app. If Restricted, documents can be exchanged only with other MDX apps.
If Unrestricted, set the Enable encryption policy to On so that users can open documents in unwrapped apps. If the receiving app is unwrapped or has encryption disabled, Citrix Endpoint Management decrypts the document. Default value is Restricted.
Restricted Open-In exception list
When the Document exchange (Open In) policy is Restricted, an MDX app can share documents with this comma-delimited list of unmanaged app IDs, even if the Document exchange(Open In) policy is Restricted and Enable encryption is On.The default exception list allows Office 365 apps:
Only Office 365 apps are supported for this policy.
Be sure to consider the security implications of this policy. The exception list allows content to travel between unmanaged apps and the MDX environment.
Inbound document exchange (Open In)
Blocks, restricts, or allows inbound document exchange operations for this app. If Restricted, documents can be exchanged only with other MDX apps. Default value is Unrestricted.
If Blocked or Restricted, you can use the Inbound document exchange whitelist policy to specify apps that can send documents to this app.
Options: Unrestricted, Blocked, or Restricted
App URL schemes
iOS apps can dispatch URL requests to other apps that have been registered to handle specific schemes (such as “
http://”). This facility provides a mechanism for an app to pass requests for help to another app. This policy serves to filter the schemes that are passed into this app for handling (that is, inbound URLs). Default value is empty, meaning that all registered app URL schemes are blocked.
The policy should be formatted as a comma-separated list of patterns in which each pattern may be preceded by a plus “+” or minus “-“. Inbound URLs are compared against the patterns in the order listed until a match is found. Once matched, the action taken is dictated by the prefix.
- A minus “-“ prefix blocks the URL from being passed into this app.
- A plus “+” prefix permits the URL to be passed into the app for handling.
- If neither “+” or “-“ is provided with the pattern, “+” (allow) is assumed.
- If an inbound URL does not match any pattern in the list, the URL is blocked.
The following table contains examples of App URL schemes:
|Scheme||App that requires the URL scheme||Purpose|
|ctxmobilebrowser||Secure Web-||Permit Secure Web to handle HTTP: URLs from other apps.-|
|ctxmobilebrowsers||Secure Web-||Permit Secure Web to handle HTTPS: URLs from other apps.|
|ctxmail||Secure Mail-||Permit Secure Mail to handle mailto: URLs from other apps.|
|COL-G2M||GoToMeeting-||Permit a wrapped GoToMeeting app to handle meeting requests.|
|ctxsalesforce||Citrix for Salesforce-||Permit Citrix for Salesforce to handle Salesforce requests.|
|wbx||WebEx||Permit a wrapped WebEx app to handle meeting requests.|
App interaction (outbound URL)
Domains excluded from URL filtering
This policy excludes outbound URLs from any “Allowed URLs” filtering. Add a comma-separated list of fully qualified domain names (FQDN) or DNS suffixes to exclude from the “Allowed URLs” filtering. If this policy is empty (the default), the defined “Allowed URLs” filtering processes are URLs. If this policy contains any entries, those URLs with host fileds matching at least one item in the list (via DNS suffix match) are sent unaltered to iOS, bypassing the “Allowed URLs” filtering logic. Default value is empty.
iOS apps can dispatch URL requests to other applications that have been registered to handle specific schemes (such as
"http://"). This facility provides a mechanism for an app to pass requests for help to another app. This policy serves to filter the URLs that are passed from this app to other apps for handling (that is, outbound URLs).
The policy should be formatted as a comma-separated list of patterns in which each pattern may be preceded by a plus “+” or minus “-“. Outbound URLs are compared against the patterns in the order listed until a match is found. Once matched, the action taken is dictated by the prefix. A minus “-“ prefix blocks the URL from being passed out to another app. A plus “+’ prefix permits the URL to be passed out to another app for handling. If neither “+” or minus “-“ is provided with the pattern, “+” (allow) is assumed. A pair of valus separated by “=” indicates a substitution where occurrences of the first string are replaced with the second. You can use regular-expression “^” prefix to search string to anchor it to the beginning of the URL. If an outbound URL does not match any pattern in the list, it will be blocked.
If the setting is blank, all URLs are blocked, except for the following:
- +citrixreceiver: +tel:
The following table contains examples of allowed URLs:
|^mailto:=ctxmail:||All mailto: URLs open in Secure Mail.|
|^http:||All HTTP URLs open in Secure Web.|
|^https:||All HTTPS URLs open in Secure Web.|
|^tel:||Allows user to make calls.|
|-//www.dropbox.com||Blocks Dropbox URLs dispatched from managed apps.|
|+^COL-G2M:||Permits managed apps to open the GoToMeeting client app.|
|-^SMS:||Blocks the use of a messaging chat client.|
|-^wbx:||Blocks managed apps from opening the WebEx client app.|
|+^ctxsalesforce:||Permits Citrix for Salesforce to communicate with your Salesforce server.|
Allowed Secure Web domains
This policy only affects “Allowed URLs” policy entries that would redirect a URL to the Secure Web app (^ http:=ctxmobilebrowser: and ^https:=ctxmobilebrowsers:). Add a comma-separated list of fully qualifies domain names (FQDN) or DNS suffixes allowed to redirect to the Secure Web app. If this policy is empty (the default), all domains can redirect to the Secure Web app. If this policy contains any entries, then only those URLs with host fields matching at least one item in the list (via DNS suffix match) redirect to the Secure Web app. All other URLs are sent unaltered to iOS, bypassing the Secure Web app. Default value is empty.
Be sure to consider the security implications of policies that block apps from accessing or using phone features. When those policies are Off, content can travel between unmanaged apps and the Secure environment.
If On, prevents an app from directly using the camera hardware. Default value is OFF.
Block Photo Library
If On, prevents an app from accessing the Photo Library on the device. Default value is On.
Block mic record
If On, prevents an app from directly using the microphone hardware. Default value is On.
If On, prevents an app from directly using dictation services. Default value is On.
Block location services
If On, prevents an app from using the location services components (GPS or network). Default value is Off for Secure Mail.
Block SMS compose
If On, prevents an app from using the SMS compose feature used to send SMS/text messages from the app. Default value is On.
Block email compose
If On, prevents an app from using the email compose feature used to send email messages from the app. Default value is On.
If On, prevents an app from using iCloud for the storing and sharing of settings and data.
iCloud data file is controlled by the Block file backup policy.
Default value is On.
Block look up
If On, prevents an app from using the Look Up feature, which searches for highlighted text in the Dictionary, iTunes, the App Store, movie showtimes, nearby locations and more. Default value is On.
Block file backup
If On, prevents data files from being backed up by iCloud or iTunes. Default value is On.
If On, prevents an app from using AirPrint features for printing data to AirPrint-enabled printers. Default value is On.
If On, prevents an app from using AirDrop. Default value is On.
Block Facebook and Twitter APIs
If On, prevents an app from using the iOS Facebook and Twitter APIs. Default value is On.
Obscure screen contents
If On, when users switch apps, the screen is obscured. This policy prevents iOS from recording screen contents and displaying thumbnails. Default value is On.
Block 3rd party keyboards (iOS 11 and later only)
If On, prevents an app from using third-party keyboard extensions on iOS 8+. Default value is On.
Block app logs
If On, prohibits an app from using the mobile productivity app diagnostic logging facility. If Off, app logs are recorded and may be collected by using the Secure Hub email support feature. Default value is Off.
App network access
Tunneled - Web SSO is the name for the Secure Browse in the settings. The behavior is the same.
The settings options are as follows:
- Use Previous Settings: Defaults to the values you had set in the earlier policies. If you change this option, you shouldn’t revert to Use Previous Settings. Also note that changes to the new policies do not take effect until the user upgrades the app to version 18.12.0 or later.
- Blocked: All network access is blocked. Networking APIs used by your app will fail. Per the previous guideline, you should gracefully handle such a failure.
- Unrestricted: All network calls go directly and are not tunneled.
- Tunneled - Full VPN: All traffic from the managed app tunnels through Citrix Gateway.
- Tunneled - Web SSO: The HTTP/HTTPS URL is rewritten. THis option allows only the tunneling of HTTP and HTTPS traffic. A significant advantage of Tunneled - Web SSO is single sign-on (SSO) for HTTP and HTTPS traffic and also PKINIT authentication. On Android, this option has low setup overhead and is thus the preferred option for web browsing types of operations.
- Tunneled - Full VPN and Web SSO: Permits switching between VPN modes automatically as needed. If a network request fails due to an authentication request which cannot be handled in a specific VPN mode, it is retried in an alternate mode.
If one of the Tunneled modes is selected, a per-app VPN tunnel in this initial mode is created back to the enterprise network, and Citrix Gateway split tunnel settings are used. Citrix recommends Tunneled Full VPN for connections that employ client certificates or end-to-end SSL to a resource in the enterprise network. Citrix recommends Tunneled - Web SSO for connections that require single sign-on (SSO).
micro VPN session required
If Yes, the user must have a connection to the enterprise network and an active session. If No, an active session is not required. Default value is Use Previous Setting. For newly uploaded apps, the defaut value is No. Whichever setting was selected prior to the upgrade to this new policy remains in effect until an option other than Use Previous Setting is selected.
micro VPN session required grace period (minutes)
This value determines how many minutes users can use the app before the Online Session Required policy prevents them from further use (until the online session is validated). Default value is 0 (no grace period). This policy isn’t applicable for integration with Microsoft Intune/EMS.
When used with the StoreFront certificate integration service, this label identifies the specific certificate required for this app. If no label is provided, a certificate is not made available for use with a public key infrastructure (PKI). Default value is empty (no certificate used).
Comma-delimited list of FQDNs or DNS suffixes to be accessed directly instead of through a VPN connection. This only applies to the Tunneled - Web SSO mode when Citrix Gateway is configured with Split tunnel reverse mode.
Default log output
Determines which output media are used by mobile productivity app diagnostic logging facilities by default. Possibilities are file, console, or both. Default value is file.
Default log level
Controls default verbosity of the mobile productivity app diagnostic logging facility. Each level includes levels of lesser values. Range of possible levels includes:
- 0 - Nothing logged
- 1 - Critical errors
- 2 - Errors
- 3 - Warnings
- 4 - Informational messages
- 5 - Detailed informational messages
- 6 through 15 - Debug levels 1 through 10
Default value is level 4 (Informational messages).
Max log files
Limits the number of log files retained by the mobile productivity app diagnostic logging facility before rolling over. Minimum is 2. Maximum is 8. Default value is 2.
Max log file size
Limits the size in megabytes (MB) of the log files retained by the mobile productivity app diagnostic logging facility before rolling over. Minimum is 1 MB. Maximum is 5 MB. Default value is 2 MB.
Redirect system logs
If On, intercepts and redirects system or console logs from an app to the Mobile Productivity Apps diagnostic facility. If Off, app use of system or console logs is not intercepted.
Default value is On.
Center point longitude
Longitude (X coordinate) of the center point of point/radius geofence in which the app is constrained to operate. When operated outside the configured geofence, the app remains locked.
Should be expressed in signed degrees format (DDD.dddd), for example “-31.9635”. West longitudes should be prefaced with a minus sign. Default value is 0.
Center point latitude
Latitude (Y coordinate) of the center point of point/radius geofence in which the app is constrained to operate. When operated outside the configured geofence, the app remains locked.
Should be expressed in signed degreed format (DDD.dddd), for example “43.06581”. Southern latitutes should be prefaced with a minus sign. Default value is 0.
Radius of the geofence in which the app is constrained to operate. When operated outside the configured geofence, the app remains locked.
Should be expressed in meters. When set to zero, the geofence is disabled. When the Block location serviced policy is enabled, geofencing does not work properly. Default is 0 (disabled).
Google Analytics level of detail
Citrix collects analytics data to improve product quality. Selecting Anonymous opts users out of including company identifiable information. Default is Complete.
If On, Citrix collects crash reports and diagnostics to help troubleshoot issues. If Off, Citrix doesn’t collect data.
Citrix might also control this feature with a feature flag. Both the feature flag and this policy must be enabled for this feature to function.
Default value is Off.
You can obtain an upload token from your Citrix Insight Services (CIS) account. If you specify this optional token, CIS gives you access to crash reports and diagnostics uploaded from your devices. Citrix has access to that same information. Default value is empty.
Send reports over Wi-Fi only
If On, Citrix sends crash reports and diagnostics only when you’re connected to a Wi-Fi network. Default value is On.
Report file cache maximum
Limits the size of the crash report and diagnostics bundles retained before clearing the cache. Minimum is 1 MB. Maximum is 5 MB. Default value is 2 MB.