Hello, I’m Robert Terakedis from VMware’s EUC Technical Marketing team.
In today’s video I’ll be covering the new Multiple Managed Accounts feature of Workspace
ONE Boxer.
We will begin by covering an overview of the Workspace ONE Boxer app and security features.
Then discuss mail account use cases.
We will then introduce the new Multiple Managed Account feature in Boxer.
Then go into technical details, including prerequisites and deployment considerations.
And end with a demo of the admin configuration and end user experience.
Workspace ONE Boxer, part of the Workspace ONE secure productivity apps suite, empowers
mobile productivity by engaging business apps to solve for mobile micro-moments and drive
digital transformation.
Available on both iOS and Android, Boxer combines consumer simplicity with enterprise security.
Before joining the VMware family of products, Boxer provided an award-winning user experience
as a consumer application that consistently received high ratings in the app store and
delivered a mobile email experience that end users would choose to use.
As part of the VMware suite of products, Boxer upholds the standard of consumer-simplicity
and provides frictionless access to enterprise email, calendar and contacts across both corporate
and employee-owned devices.
The containerization of business data and advanced management policies enables IT organizations
to exceed their enterprise security, compliance, data loss prevention, or DLP, and user privacy
requirements.
Over the past year Boxer has grown to over 300k daily active users and 1.1 million monthly
active users.
Our largest deployments include customers in technology, government, finance, oil & gas
and utilities.
Boxer meets the security needs of highly regulated or security conscious organizations by providing:
S/MIME Signing and encryption
Per-email signing and encryption options
Certificate history
OCSP revocation checking
LDAP repository integration for cross-org encryption email exchange
Simplify deploying and updating certificates with support for
End-user self service portal upload
Email attachment installation
REST API integration to certificate escrow
Email Classification
Which allows end-users to classify emails according to admin-configured templates
Fully configurable for a seamless integration with existing classification services such
as Titus and Janus
Azure Information Protection
Boxer registers as a rights management enlightened app allowing it to take advantage of the rights
management capabilities of Exchange and Office 365
Compose emails and select from the available permissions templates configured by the organization
Allows viewing of rights protected emails and enforces rights policies such as:
Prevent forward
Prevent reply-all
Block copy-paste
Block printing
Block inline editing
Open rights-protected files in Content
Derived Credentials integration which expands on the capabilities of S/MIME and certificate-based
account authentication for highly regulated organizations or government by leveraging
the shared certificate credential managed by the VMware PIV-D application.
And Modern Authentication leveraging the latest security measures of Office 365 cloud and
hybrid environments with support for the OAuth 2.0 standard and web-based authentication.
Modern authentication can leverage Workspace ONE Access conditional access policies and
two-factor authentication solutions such as RSA tokens and VMware Verify to further secure
corporate data and provide advanced access control based on device posture, location
or network.
Now that we have been introduced to Workspace ONE Boxer, let’s review different mail account
use cases.
Multiple Managed Accounts refers to different mailboxes that are are owned and managed by
a single user.
For example, a user may have an internal email account and a public, or customer-facing,
email account.
Or a user may have mail accounts for multiple subsidiaries within the same parent company
or a corporation has acquired multiple companies that each have different security policies
and use different Microsoft Exchange servers or other mail services, but all mobile devices
are managed by the same Workspace ONE UEM instance.
In addition, a user may have mailboxes for different departments, such as in government
environments.
Shared accounts refers to a user that is responsible for a mailbox along with one or more other
colleagues, such as a team mailbox or public email addresses that are monitored by multiple
employees.
Delegated accounts refers to the use case where a second user is granted access to a
mailbox or calendar of a colleague, such as an Executive Assistant or a mailbox that is
monitored while the user is on leave.
This video will focus on Multiple Managed Accounts use cases.
The other use cases are supported within Boxer and are covered in other product documentation.
Workspace ONE Boxer is the first secure mobile email client that supports multiple managed
accounts – this is by far the most requested feature for Boxer.
Before UEM version 20.08 and Boxer version 5.21, users could add multiple personal mail
accounts to Boxer, such as Gmail, but the admin could only configure one managed mail
account.
Now the administrator can configure up to three managed accounts in Boxer via the Workspace
ONE UEM console, giving the user access to mail, calendar, and contacts from up to three
separate accounts!
Each account can have unique settings, such as different Exchange servers or mail environments,
different authentication methods or different sets of DLP policies.
Administrators leverage CustomAttribute functionality in the Directory Services configuration in
order to pull in AD Attributes to configure the 2nd and third managed account.
Consider the following prerequisites before configuring multiple managed accounts in Boxer:
Boxer 5.21 and above is required for iOS and Android
Workspace ONE UEM console 20.08 or above is required.
Also, the admin must enable and configure Single Sign-On (SSO) for the SDK profile and
in Boxer’s App Policies.
The user attributes ’user principal name’ and ‘email address’ must be unique for
each managed account.
In the UEM console, these could be predefined user attributes or custom attributes.
If custom attributes are used, they need to be mapped to user attributes in Active Directory
and must exist in the AD user properties, or whatever directory services is used.
Work with your Active Directory admin to setup the second and third account unique identifiers
as sub properties of the user account.
Note the ‘user display name’ attribute does not need to be unique.
Each of the managed accounts can point to a different mail service, such as Microsoft
Exchange, O365 or Google Workspace (formally G Suite).
If certificate authentication will be configured for any of the managed mail accounts, note
that different Certificate Authorities can be used for the different managed accounts,
or the same CA can be used.
If the same CA is used to authenticate multiple managed accounts, the certificate template
must be unique for each managed account configured for certificate authentication so Exchange
can identify the different accounts.
I’d like to highlight some considerations before deploying multiple managed accounts
in Boxer:
If S/MIME will be configured for the three managed accounts, the same S/MIME certificate
template can be used across the accounts because you can add the email address user attribute
for all accounts to the same S/MIME certificate template in the SAN type section.
However, if the admin chooses to use different S/MIME certificate configurations per account,
“Defined Certificate Authority” must be set as the certificate source.
Also, if the admin is uploading user S/MIME certificates manually or via API, the same
certificate will be used for all the user’s managed accounts.
Also, be sure to identify which AD user attributes will be used to represent the user principal
name and email address for the secondary and tertiary managed accounts, configure these
attributes for the user and sync with the UEM console.
In a moment we will walk through these steps.
Finally, note that different Certificate Authorities can be used for the different managed accounts.
However, if configuring certificate authentication for the three mail accounts, and you are using
the same CA, the certificate template must be different for each managed account for
a user, so that Exchange can identify the different accounts.
If the same template is used for more than one of the user’s managed mail accounts
(adding UPN and email address for each mail account to the same template), certificate
authentication with Exchange will fail.
Now let’s walk through configuration of Multiple Managed Accounts in Boxer, including
looking at the configuration of these deployment considerations.
To start, let's take a quick look at how we've configured this demo.
First, as I run the PowerShell command, you'll see we have a user account configured with
three separate email accounts.
For simplicity, I've re-used pre-existing AD attributes to store email account information.
Still, some organizations may extend the AD schema to create new user attributes to store
additional values.
Additionally, the reason I'm using extra AD attributes is to demonstrate how you can configure
multiple managed accounts with Custom Attributes synced from Active Directory.
If I transition to the Workspace ONE UEM console, I'llI'll continue the configuration by browsing
to Groups & Settings, All Settings, System, Enterprise Integration, and Directory Services.
In the directory services screen, I'll click on "User" and scroll down to "Enable Custom
Attributes."
I can then map the additional AD attributes to a Custom Attribute value, which I'll then
Save ... and then Sync.
With those values synced, I can click on Accounts, choose my user account, and see the Custom
Attributes listed in the Details View (and you can see CustomAttribute 1 contains the
maiden name for my test account).
Back in the Settings, I'll click on Certificate Authorities and Request Templates.
The first template I've created is for the user's primary account and leverages the typical
Subject and SAN lookup values.
My Secondary request template leverages the Custom Attribute values to request a certificate
with Subject and SAN values related to the secondary email account.
I've also created an SMIME certificate request template that includes the email addresses
for both the primary and secondary email addresses.
Now, let's look at how to configure Boxer.
I've done the pre-work to enable Boxer as a device-based, volume-licensed application
from Apple.
I'll select the app and click Assign to begin assigning the app.
For demo simplicity, I'll assign the app to the org group and allocate the licenses.
I'll select that I want to prevent backup and make the app MDM managed if user-installed
on the restrictions tab.
Next, I'll click on "Email Settings" to start the multiple managed account configuration.
For the first Email Settings tab, I'll enter details of the user's primary account using
Lookup Values where possible (such as the Account Name, Domain, User name, and more).
I'll click Configure next to Authentication.
For Authentication, I'll select Certificate and choose my CA and Primary template.
Going back, I'll choose the SMIME option and configure SMIME as optional using the defined
certificate authority and my SMIME template.
Back on the Email Settings page, I'll click Add to start my secondary account configuration.
You'll see here that I'm using the next set of CustomAttribute values to configure the
account name, email domain, and more.
Similar to the primary account, I'll click configure for Authentication.
I'll again select Certificate authentication, only this time I'll choose my secondary request
template.
Going back to email settings, I'll select SMIME and configure SMIME for this account
using the same request template as before.
Finally, I'm going to add a third email account for this demo by clicking Add and completing
an additional email settings pane.
I'll enter the Account name, exchange host, domain, user name, display name, and email
address values for this account.
If I click on Authentication, you can see I"m going to leave this one set to Basic (user
name and password) authentication.
With the email settings complete, I'll click Create to finish creating the assignment.
Next, I'll click Save and then Publish.
Let's switch over to my iPad.
I'll launch Boxer and click through the privacy and analytics screens.
I get prompted for my single sign-on passcode for the Workspace ONE apps.
After entering that, Boxer displays the Welcome screen for the multiple managed accounts.
You can see all three accounts we configured in Workspace ONE UEM displayed on this welcome
screen.
As I click into the first two accounts, you see Boxer fetches the certificates delivered
via the assignment.
As I click into the third account (jdoe@emc.corp), I get prompted for the password to login to
that account.
Upon entering the password, the welcome screen completes, and Boxer continues setup.
Due to my configuration, Boxer prompts me to share Calendar and Contact access and then
asks if I'd like to receive Boxer notifications.
Boxer then continues to log in to all the accounts and fetch the mailbox per the configured
Boxer Email settings.
Boxer displays the unified inbox view by default, but I can click the top left menu to view
each account's Inbox.
Additionally, using the same menu, I can view the folder structure within each separate
mailbox.
Here are additional resources I recommend reviewing before implementing Multiple Managed
Accounts within Boxer.
Thank you for watching this overview of Workspace ONE Boxer Multiple Managed Account support.
Please visit techzone.vmware.com for additional Workspace ONE technical resources.