How To Setup VMware Workspace ONE Mobile Threat Defense (MTD)

Photo by Matthew Henry on Unsplash

Introduction

VMware Workspace ONE Mobile Threat Defense (MTD) is a new endpoint detection and response (EDR) solution for Android, iOS, and Chrome OS that was developed in partnership with Lookout. This article will serve as a step-by-step tutorial on how to setup, configure, and onboard devices to MTD using the Intelligent Hub app. For information on what outcomes MTD can provide and how it works, I recommend checking out VMware Tech Zone. I’ve also included additional resources at the end of this article as well as links to getting quick, read-only access to an actual MTD tenant through VMware TestDrive.

Step 1: Create a Service Account

MTD integrates with UEM via REST API. For this to work, MTD will need to be given credentials for an account with the least admin privileges necessary. It is recommended to create a custom admin role in UEM that has the minimum necessary permissions needed for MTD to work. Then, assign the role to a an admin account. MTD will use the credentials of that account to make API calls to UEM to fetch user, group, device, and admin info as well as assign tags to devices in UEM based on onboarding and threat state.

Create a Custom Admin Role

1. Log into your Workspace ONE UEM admin console
2. Click ACCOUNTS > Administrators > Roles
3. Click ADD ROLE
4. Enter a name for the custom role such as MTD_API_Admin_Role and a description
5. Under Categories, click API > REST and then add Read permissions for Admin, Apps, Devices, Groups, and Users
6. Click Device Management > Bulk Management and add both Read and Edit permissions
7. Click Settings > Tags and add both Read and Edit permissions
8. Click SAVE

Create a custom admin role with least privileges.

Create an Admin Account

Create either a basic admin account (i.e., an account that exists in UEM only) or create a directory based account.

1. Click ACCOUNTS > Administrator > List View
2. Click ADD > Add Admin
3. If creating a basic account, leave the default user type set to BASIC and the populate the required fields
4. If using a newly created directory account, set the user type to DIRECTORY and then import the account to UEM
5. Click Roles tab
6. Enter the Organization Group you want the account to have access to and enter the custom MTD_API_Admin_Role role you created previously
7. Click SAVE
8. Enter your admin security PIN to confirm account creation

Import or create a new admin account in UEM and assign the custom MTD role.

(Optional) Create a Client Certificate

If you want MTD to use the recommended certificate authentication method instead of basic authentication, then follow these steps. Please note you must specify a password when generating the client cert. This password is used to protect the private key of the cert and you must re-enter this password anytime you wish to export the cert. If you don’t remember the password in the future or you wish to revoke the cert, you can always clear out the client certificate, generate a new cert, and then upload the new cert to the MTD admin console.

1. Click the pencil icon to edit the account you just created
2. Click API tab
3. Select CERTIFICATES
4. Enter a password
5. Click GENERATE CLIENT CERTIFICATE
6. Click EXPORT CLIENT CERTIFICATE
7. Click SAVE

(Recommended) Generate a client certificate for MTD cert based auth to UEM.

Step 2: Create an API Key

Create a REST API key in UEM to be used by MTD. When authenticating to the UEM REST API using basic auth or certificate auth, an API key must also be provided in the HTTP headers. It is recommended to created API keys for each service integrating with UEM because the API key will also set call limits and help distinguish which service (or admin) is making the calls.

1. From the UEM admin console, click GROUPS & SETTINGS > Settings > System > Advanced > REST API
2. Ensure Enable API Access is set to ENABLED
3. Click ADD
4. In the Service text field, enter a name
5. (Optional) Enter a description and set allowed domains
6. Click SAVE
7. Copy the API key for later use

Create an API Key in UEM.

Step 3: Create a Smart Group

Create a new Smart Group in UEM or use an existing one to enable for MTD.

1. From the UEM admin console, click GROUPS & SETTINGS > Groups > Assignment Groups
2. Click ADD SMART GROUP
3. Enter a name for the Smart Group
4. Click SAVE

Create a Smart Group.

Step 4: Create Device Tags

MTD tracks various devices states in the following categories: enrollment to MTD, device connection status to MTD, and risk state. MTD continuously re-evaluates devices state and can sync this info back to UEM by way of device tagging. Currently, there are 10 device states that span from enrollment to connectivity to threat risk. You may optionally create a device tag for each of these states in UEM. You can then map the tags you created in UEM to the MTD device states in the MTD admin console. MTD will assign and/or remove tags based on evaluation of device state.

MTD Device States:

• MTD — Pending
• MTD — Activated
• MTD — Deactivated

MTD Connection States:

• MTD — Disconnected (devices that have lost connectivity with MTD)
• MTD — Unreachable (devices that that are unreachable by MTD)

MTD Risk States:

• MTD — Threats Present
• MTD — Low Risk
• MTD — Medium Risk
• MTD — High Risk
• MTD — Secured

Create Device Tags in UEM

1. From the UEM admin console, click GROUPS & SETTINGS > Settings > Devices & Users > Advanced > Tags
2. Click CREATE TAG
3. Enter a name for the tag
4. Click SAVE
5. Repeat for the all the listed states above or just the ones you wish to track

Create devices tags for MTD to assign to devices based on onboarding and threat state.

Step 5: Integrate MTD with UEM

We are nearly through with the integration and then the real fun begins!

Create the MTD Connection to the UEM REST API

1. Login to the MTD admin console: https://mtp.lookout.com
2. Click Integrations tab
3. Click Workspace ONE
4. Enter a friendly name for the connection
5. Enter the URL for the Workspace ONE UEM API server
6. (Optional) To enable mutual TLS authentication with MTD and UEM, upload the full web certificate chain of the UEM API server saved in PEM format
7. Enter the API token you created in step 2
8. If enabling certificate authentication, upload the client certificate you generated in step 1 and then entire the password you used to generate the cert in the Passphrase text field; otherwise, select the Basic Authentication radio button and enter the password for the API account
9. (Optional) Enter any proxy settings if these are a requirement for your organization
10. Click CREATE INTEGRATION

Configure the REST API integration to UEM.

Enable Device Enrollment and State Syncing in MTD

1. From the MTD admin console, scroll down to the Enrollment Management section of the Workspace ONE integration
2. Toggle device enrollment to ON
3. Enter the name of the Smart Group you created in step 3
4. (Optional) Enable automatic push notifications to enrolled devices upon activation of MTD
5. Scroll down to the Sate Sync section
6. Toggle ON “synchronize device status to Workspace ONE”
7. For each of the device state tags you created in step, toggle on the corresponding state in MTD and select the appropriate tag
8. (Optional) Enter an email to receive MTD error reports
9. Click SAVE CHANGES

Configure Enrollment Management and Sate Sync in MTD.

Step 6: Deploy Your Agent

The final step is to enable or deploy your MTD agent using either the Workspace ONE Intelligent Hub or the Lookout for Work App. At time of publishing this tutorial, the Intelligent Hub and Lookout for Work App have near feature parity with a few exceptions noted below. As MTD matures, the feature gap between the two agents will narrow or full parity will be achieved.

Agent Capabilities By Deployment Type

Today the Lookout for Work agent provides these additional features centered around content inspection that you won’t be able to leverage if deploying through Hub:

• Explicitly block specific content (set deny-listed content)
• Block malicious, offensive, and phishing content

Content that you’ve explicitly blocked or content that MTD deems to be in the malicious, offensive, or phishing categories can be blocked if using the Lookout for Work app. The content will be blocked for both foreground and background processes for native mobile apps including the mobile browsers. Again, the Hub app supports all other features today and I expect this content inspection ability should come to Hub in a future release. For a full list of feature comparisons, please see the Capabilities by Deployment Type guide on VMware Docs.

Choosing Between Intelligent Hub and Lookout for Work App Deployments

Deciding which agent to leverage can be daunting, but your device management scenarios and the end user experience you want to achieve can help you reach a conclusion. In addition, depending on your use cases and how you manage or separate them in UEM you may be able to pick different deployment types based on use case.

Get Aron Aperauch’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Deploy using Intelligent Hub if…

• Your existing mobile fleet is already enrolled/managed using Hub.
• You want a simple EDR onboarding and activation experience for existing and new users that occurs at time of onboarding/management.
• You want all the same protections and features as the Lookout app to address malware, zero day, MITM, and other vulnerability concerns, but don’t have any need to inspect user traffic for content protection (a possibility if you have end-user privacy restrictions).

Deploy using Lookout for Work if…

• You have devices that are not managed using Hub (e.g., iOS devices that were enrolled through a browser such as Safari instead of Hub).
• You don’t mind deploying a dedicated app after the device becomes managed by UEM and requiring the end-user to manually activate the app.
• Phishing and content protection is required.

Deploying the Workspace ONE Intelligent Hub App

Enabling MTD in Hub is simple and easy! In short, you enable the MTD feature and supply your MTD enrollment code through the WS1 SDK settings which Hub syncs from UEM. The remainder of this tutorial uses the Hub deployment type.

1. Login to your MTD admin console
2. Click System > Account
3. Under the Global Enrollment Code section, copy your code to be used later in step 6 below

Obtain your MTD Enrollment Code.

1. Login to your UEM admin console
2. Click GROUPS & SETTINGS > Settings > Apps > Settings and Policies > Settings
3. If you are not already overriding these settings, then click the Override radio button
4. Set the Custom Settings toggle to ENABLED if it is not already
5. If you don’t have any existing JSON in the Custom Settings text box, then copy the full JSON below and paste to the text box; otherwise, just copy the mtdSettings JSON object and add as a new element (don’t forget to add a comma before pasting the new object)
6. Replace ABCDEFG with the MTD enrollment code for you tenant that you obtained previously

{
  "mtdSettings": {
    "isEnabled": true,
    "enrollmentCode": "ABCDEFG"
  }
}

Enable MTD for Workspace ONE Intelligent Hub.

Deploying the Lookout for Work App

Deploying the Lookout for Work app requires a few more steps than the Hub deployment type. For now, the best and most up-to-date guidance is VMware Docs. Please note the Hub deployment type was used for the purpose of this tutorial.

Finished: Check Out the MTD Admin Console

MTD is now integrated with your UEM tenant using the Workspace ONE Intelligent Hub! If you have devices already managed by UEM and targeted by the Smart Group you are using to sync devices from UEM to MTD, then those devices should begin to populate in the MTD admin console within a few minutes. If you don’t have any devices enrolled or managed by UEM yet, then those devices will appear once managed by UEM.

Short demo of the MTD admin console.

What’s Next?

Check-Out a Real MTD Integration on VMware TestDrive

Whether your a new to Workspace ONE or an existing customer, you can access VMware TestDrive to see capabilities of the platform first-hand. What’s even better is it’s free! After you register, you can access a Workspace ONE UEM, Access, MTD, and other solutions of the platform as a read-only admin and even enroll a test device to see the end-user experience.

MTD admin console in VMware TestDrive.

Get a Free Trial of MTD

If you’re already a Workspace ONE customer, you can obtain a free trial of MTD by reaching out to your account executive. Not sure whom that might be or interested in learning more about the platform? Contact VMware Sales to get started.

Integrate Lookout with Workspace ONE Intelligence

Device tagging is great and useful to assigning or un-assigning resources to devices based on, for example, risk state. However, that’s not the only way you automate device actions and mitigate risks. Since Lookout is a Workspace ONE Trust Network partner, you can integrate Lookout with Workspace ONE Intelligence for added reporting, dashboards, and automations.

Additional Resources

• Solution Brief: Workspace ONE Mobile Threat Defense Solution Overview
• YouTube: MTD Demo, Tech Overview, and Architecture Videos
• Tech Zone Blog: Mobile Threat Defense
• Admin Guide: Workspace ONE Mobile Threat Defense
• VMware Test Drive