The MaaS360 MDM Agent must provide an alert via the trusted channel to the MDM server for the following event: change in enrollment state.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-82195	PP-MDM-302001	M360-10-300100	SV-96909r1_rule	2019-08-06	1

Description
Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an MDM server receives such an alert from a MaaS360 MDM Agent, it indicates that the security policy may no longer be enforced on the mobile device. This enables the MDM administrator to take an appropriate remedial action. SFR ID: FAU_ALT_EXT.2.1

ℹ️ Check
Review the MaaS360 server configuration to verify the MaaS360 Agent alerts the MDM via the trusted channel to the MaaS360 server for the following event: change in enrollment status. On the MaaS360 Console, complete the following steps: 1. Navigate to Security >> Compliance Rules. 2. Have the system administrator identify the applicable "Change in enrollment status" rule set name. 3. Select rule set name in list. 4. Under “Enforcement Rules”, verify the "Enrollment" box is checked, all boxes are checked for "Trigger Action on Managed Status", and "Enforcement Action" is set to "alert". If there are no "Change in enrollment status" rule set names set up or rules that have been set up are not configured correctly, this is a finding.

ℹ️ Check

Review the MaaS360 server configuration to verify the MaaS360 Agent alerts the MDM via the trusted channel to the MaaS360 server for the following event: change in enrollment status. On the MaaS360 Console, complete the following steps: 1. Navigate to Security >> Compliance Rules. 2. Have the system administrator identify the applicable "Change in enrollment status" rule set name. 3. Select rule set name in list. 4. Under “Enforcement Rules”, verify the "Enrollment" box is checked, all boxes are checked for "Trigger Action on Managed Status", and "Enforcement Action" is set to "alert". If there are no "Change in enrollment status" rule set names set up or rules that have been set up are not configured correctly, this is a finding.

✔️ Fix
Configure the MaaS360 Agent to alert via the trusted channel to the MaaS360 server for the following event: change in enrollment status On the MaaS360 Console, complete the following steps: 1. Navigate to Security >> Compliance Rules >> Add Rule Set and Create a rule. 2. Under Basic Settings >> Select Applicable Platforms, select the MOS, and under "Event Notification Recipients", input the email for the system administrator who will get the notification. 3. Under “Enforcement Rules”, select Enforcement Rules and ensure the "Enrollment" box is checked and that all boxes for "Trigger Action on Managed Status" are checked. 4. Ensure "Enforcement Action" is set to "alert".

✔️ Fix

Configure the MaaS360 Agent to alert via the trusted channel to the MaaS360 server for the following event: change in enrollment status On the MaaS360 Console, complete the following steps: 1. Navigate to Security >> Compliance Rules >> Add Rule Set and Create a rule. 2. Under Basic Settings >> Select Applicable Platforms, select the MOS, and under "Event Notification Recipients", input the email for the system administrator who will get the notification. 3. Under “Enforcement Rules”, select Enforcement Rules and ensure the "Enrollment" box is checked and that all boxes for "Trigger Action on Managed Status" are checked. 4. Ensure "Enforcement Action" is set to "alert".