Installation of Kaspersky Endpoint Security for Android in device owner mode

Expand all | Collapse all

Device owner mode is the device operation mode for company-owned Android devices. This mode lets you have full control over the entire device and configure a wide range of device functions.

Kaspersky Security Center lets you install the Kaspersky Endpoint Security for Android app in device owner mode by generating a QR code for app installation on the device.

Kaspersky Endpoint Security for Android is installed on the mobile devices of users whose user accounts have been added in Kaspersky Security Center. For more details about user accounts in Kaspersky Security Center, please refer to Kaspersky Security Center Help.

Ways to install the app

The Kaspersky Endpoint Security for Android app can be installed via a QR code in one of the following ways:

• Download the app from Kaspersky website

  Choose this method for mobile devices that can access the internet to download the APK installation file from the Kaspersky website. The app will then be updated using Google Play or HUAWEI AppGallery.

• Download the app installation package from Kaspersky Security Center

  The app's installation package will be downloaded from the Kaspersky Security Center server. The app will also be updated through Kaspersky Security Center using policy settings. You can also choose this method if mobile devices in your company have no access to the internet.

  For this method, follow the steps below before generating a QR-code:

  1. Create and configure an app installation package.
  2. Create a standalone installation package.

     When deploying the app via the installation package downloaded from Kaspersky Security Center, after the device is reset to factory settings and the QR code is scanned, the Blocked by Play Protect message may appear on the device. The issue is caused by the installation package signing certificate being different from the one specified in Google Play. The user should continue the installation by choosing Install anyway. If OK is selected, the installation process will be interrupted and the device will be reset to factory settings.

Generating QR code for app installation

To generate a QR code for app installation in device owner mode:

1. In the console tree, select the Mobile Device Management → Mobile devices folder.
2. In the workspace of the Mobile devices folder, click the Add mobile device button.

   This starts the New Mobile Device Connection Wizard. Follow the instructions of the Wizard.

3. In the Operating system section, select Android.
4. In the Device type section, select Company-owned device (device owner mode).
5. In the Network for downloading the Kaspersky Endpoint Security app section, select one of the following options:
   • Prompt the user to select a Wi-Fi network on the device

     If you choose this option, the device user will be prompted to connect to any available Wi-Fi network for downloading the app.

     This option is selected by default.

   • Use only the specified Wi-Fi network (Android 9.0+)

     If you choose this option, the device will try to automatically connect to the network that you have specified. This option is supported on Android 9.0 or later.

     Be sure to correctly specify all the network parameters. Otherwise, if any parameter is incorrect or the network is not available, the installation process will be interrupted and the device will be reset to the factory settings.

     To configure the connection for the required Wi-Fi network, click the Specify network button. In the Wi-Fi network for downloading Kaspersky Endpoint Security window, specify the following parameters:

     • Service set identifier (SSID)

       Specifies a name of a wireless network with an access point (SSID). The wireless network name should not be longer than 32 characters.

     • Hidden network

       Specifies whether the selected network broadcasts its SSID.

       The checkbox is cleared by default.

     • Network protection

       Specifies a wireless network security type. Possible values:

       • Open - If selected, the network is not protected (default).
       • WEP (Android 9 or earlier) - If selected, the network is protected using the WEP protocol. This option requires entering a password for accessing the network and applies only to Android 9 and earlier.
       • WPA2 PSK - If selected, the network is protected using the WPA 2 PSK security protocol. This option requires entering a password for accessing the network.
     • Password (will be sent in unencrypted form)

       Specifies a password for accessing a wireless network protected using a WEP or WPA2 PSK protocol. The password will be sent in QR code.

     • Do not use proxy server

       Specifies that proxy server is not used (default).

     • Use proxy server

       Specifies the use of proxy server. If this option is selected, you need to provide proxy server address and port. You can also specify a list of sites for which the proxy will be bypassed.

     • Proxy server address

       Specifies the IP address or the symbol name (web-address) of the proxy server. The maximum number of symbols is 256.

     • Proxy server port

       Specifies the port number of the proxy server. The value should be in the interval between 0 and 65536.

     • Do not use proxy server for addresses

       Specifies addresses of websites for which the proxy server should not be used.

       For example, you can enter the address example.com. In this case, the proxy server will not be used for the addresses pictures.example.com, example.com/movies, etc. The protocol (for example, http://) can be omitted.

     • PAC file URL

       A URL to a proxy auto-configuration (PAC) file for the Wi-Fi network.

   • Try to use mobile data (Android 8.0+)

     If you choose this option, the device will try to use mobile data to download the app. If the device does not have a SIM card, or the mobile network is not available, the user will be prompted to select any available Wi-Fi network.

     This option is supported on Android 8.0 or later.

6. In the Additional section, select the Enable all system apps check box if you want system apps to be active on the device. If the check box is cleared, all system apps are disabled.
7. Click Next.

   Kaspersky Security Center checks for administration plug-in updates. If Kaspersky Security Center detects updates, you can install the new version of the administration plug-in. When the administration plug-in is updated, you can accept the Terms and Conditions of the End User of the License Agreement (EULA) and additional Statements for Kaspersky Endpoint Security for Android. If the administrator accepts the License Agreement and additional Statements in Administration Console, Kaspersky Endpoint Security for Android skips the acceptance step during installation of the app.

8. On the Method to install Kaspersky Endpoint Security for Android on devices in device owner mode page, select an installation method:
   • Download the app from Kaspersky website
   • Download the app installation package from Kaspersky Security Center

     If you choose this option, leave the Allow HTTP use for app download in device owner mode check box selected to ensure the app is downloaded. Otherwise, the app will be downloaded via HTTPS only if the Kaspersky Security Center Web Server certificate was issued by a trusted certificate authority.

   For more details about these methods, see the Ways to install the app section above.

9. On the Select users page of the Wizard, select one or more users for installation of Kaspersky Endpoint Security for Android to their mobile devices.

   If a user is not in the list, you can add a new user account without exiting the New Mobile Device Connection Wizard.

10. On the Certificate source page of the Wizard, select the source of the certificate for protection of data transfer between Kaspersky Endpoint Security for Android and Kaspersky Security Center:
    • Issue certificate through Administration Server tools. In this case, the certificate will be created automatically.
    • Specify certificate file. In this case, your own certificate must be prepared ahead of time and then selected in the window of the Wizard. This option cannot be used if you want to install Kaspersky Endpoint Security for Android to several mobile devices. A separate certificate must be created for each user.
11. On the User notification method page, select the method used to forward the QR code for the app installation:
    • Select Show QR code in wizard to scan the QR code with the camera of the mobile device on which you want to install Kaspersky Endpoint Security for Android.
    • Select Send QR code to user to send the QR code by email to users of your organization. If you select this method, specify email addresses. Make sure that the email address is specified in the user account settings in Kaspersky Security Center. The users then need to scan the QR code using the camera of their mobile device to install the app.
12. On the Result page, verify the information and save the QR code.
13. Click Finish to close the New Mobile Device Connection Wizard.

Additional configuration on the Android device is required to install Kaspersky Endpoint Security for Android in device owner mode.

After installing Kaspersky Endpoint Security for Android on users' mobile devices, you will be able to configure the settings for devices and apps by using group policies. You will also be able to send commands to mobile devices for data protection in case devices are lost or stolen.