Mobile Device Application Management

LJMU are rolling out a Microsoft Application Protection Policy to protect its corporate data when any of the Microsoft Office 365 apps are accessed on a mobile device. This will include Outlook, Teams, OneDrive and any of the Office suite of applications.

Please note
The protection policy only applies to LJMU corporate Office 365 applications. No personal applications or data will be affected.

The Policy has been implemented to safeguard the University from the following:

Data being copied out of a corporate JMU application and into a private application. e.g. the content of an email being copied and then paste into a Facebook status or WhatsApp chat.
Corporate data being saved onto personal devices. All corporate data must remain in either OneDrive or SharePoint Online.
Corporate University emails being accessed via personal and third-party email applications such as those found on Apple or Android devices.
To enforce Multi-factor authentication when accessing our accounts from a mobile device.

What this means

To access any LJMU corporate Office 365 applications from a mobile device you will have to pass a Multi-Factor Authentication prompt. We strongly recommend using the Microsoft Authenticator app (Instructions are below). If you’re already using Multi-Factor Authentication to access other LJMU services you may already have done this. If not please click on this link to configure your MFA settings.

Any access to your LJMU email or calendar will have to be done via the Microsoft Outlook app or if you are accessing them via the Outlook webpage you will need to use the Microsoft Edge browser to access the webpage. When using the Edge browser, you will have to log in to the browser using your username@ljmu.ac.uk credentials.

Third party mail and calendar apps such as Android and Apple will be blocked from accessing your LJMU email and calendar. On Android you can share your Outlook calendar with the Android calendar app. This is currently not supported on Apple devices.

When accessing any corporate Office 365 application via your mobile device you will now be required to enter a 6-digit PIN or use the devices' biometrics such as fingerprint or facial recognition to access the applications. If the application is left inactive for 180 minutes you will be asked again to authenticate again in order to continue to use those applications.

Documents and files produced in your corporate LJMU Microsoft applications e.g., the ones requiring your LJMU credentials to log in to can only be saved in your LJMU OneDrive account or an LJMU SharePoint Online site. Once saved you will not be able to copy any part of those files into other applications e.g., WhatsApp or another non-LJMU instance of Office 365.

Once an email is sent from your LJMU email account again you will not be able to copy any part of that email into a non-corporate LJMU application.

Please note
This does not affect any non-LJMU corporate apps on your mobile device. Personal emails, a non-LJMU Office 365 application and local file storage are not affected. This as been enabled only when using an Office 365 application logged in with your LJMU credentials.

Apple set up

Installing Microsoft Authenticator on an Apple Device

When using Multi-Factor authentication you may already have installed Microsoft Authenticator. If this is the case, you can ignore these steps and go straight to Opening my Apps on an Apple Device.

Open the Apple Store and search for Microsoft Authenticator.
Click Get as you would when downloading any app from the app store to start the download.
Once Downloaded click open

4. As the app opens you will be asked to register your device.

5. Once your device is registered you can open any existing LJMU Office 365 applications you have installed. You can download the following apps from the app store

Microsoft Outlook
Microsoft Teams
Microsoft Office
Microsoft OneDrive

Please note
We have guides available on our webpages on how to install these apps.

Opening my Apps on an Apple Device

The first time you open an LJMU Office 365 app after having successfully registered Microsoft Authenticator you will be presented with the following message:

Click OK and then restart the app.

Next, you’ll be prompted to set up a 6 digit PIN:

The PIN is used when accessing any of the LJMU Office 365 apps. If you’ve enabled biometric log in on your device such as finger or facial recognition then Office 365 apps will accept that instead of the PIN. You will still be required to configure a PIN as a backup. PINs can not be sequential, for example 123456 or 456789.

You will also be asked to log in with your PIN or biometrics if the app you are using has been inactive for 180 minutes.

When entering your PIN, you will have 5 attempts to enter it correctly before you will be asked to reauthenticate with your username and password and to reset your PIN.

Android set up

Installing Company Portal on an Android Device

On Android devices you will need to install the Microsoft Company Portal which is available in the Google Play Store. Simply search Microsoft Company Portal in the Google Play Store and download it as you would any app. If you install any Office 365 apps and try to access them without the Company Portal being installed, you will be redirected automatically to install the Portal.

If you remove the Company Portal, you will lose access to your LJMU Office 365 apps until it is reinstalled.

To access the Company Portal, click on the Company Portal app and you will be asked to log in (please use your username@ljmu.ac.uk). The apps in the company portal are just links to the Google Play Store.

You can download the following Office 365 apps from the Google Play Store or via the Company Portal.

Microsoft Outlook
Microsoft Teams
Microsoft Office
Microsoft OneDrive

Please note
We have guides available on our webpages on how to install these apps.

If you try to access your LJMU Office 365 applications without downloading the Company Portal, you’ll receive the following message:

Either remove the account and log into your personal non-LJMU Office 365 account if you have one or download the portal as above.

Opening my Apps on an Android Device

The first time you open an LJMU Office 365 app after having successfully registered Company Portal you will be presented with the following message.

Click Continue

Next, you’ll be asked to configure a 6-digit PIN. Please note that the PIN cannot be sequential, for example 123456 or 345678

Should you ever need to reset your PIN the best way is to delete Company Portal and re-add it, going through the set-up once again.

If you have configured your device to accept a fingerprint for authentication, the 365 app will accept this, or you can say cancel and enter your PIN. Fingerprint authentication will only work on devices with android 6.0 or greater. After 180 minutes of inactivity, you will be required to re authenticate.

If you are using multiple 365 apps, for example Outlook and Teams, you only have to authenticate once until you are seen as inactive.

Frequently Asked Questions

Can the University lock my phone or wipe my device?

No, we cannot remotely lock your phone, we do not manage the device. We can only wipe the data held within the LJMU Office 365 apps. We cannot wipe your device.

I’ve tried to install the Office 365 apps but it’s not letting me install them?

If you are using an Apple device you need to ensure your device is running either the latest operating system version of ios or one version below. On an android device, you need to be running version 9 or greater. It is a security risk to not be running the latest supported operating systems.

Can I avoid having my device being managed by Mobile Application Management (MAM)?

If you want to access university data on your device then you cannot avoid MAM. If you try and access email via the web and not through the Outlook app on your device then you will need to install the Microsoft Edge browser which is MAM managed.

Can I install the authenticator app and not be MAM registered?

Yes you can, you only need to be registered for MAM if you need to access the Office 365 apps on your device including Outlook and Teams.

Outlook is asking to sync my contacts, why is it doing this?

When you first configure Outlook it will ask to sync your contacts to the phone. What this is doing is making any contacts you have in Outlook available to the apps on your phone. This is not syncing your personal phone contacts to Outlook. If you don't want to sync your Outlook contacts to your phone you can turn this off. On Apple, go to settings (cog symbol) select your account and turn off save contacts. On Android, go to settings (cog symbol) select your account and turn off sync contacts. On Android you may get notified this is now turned off. To disable the notification, please go to Android settings, Apps, Outlook, notification categories, turn off in-app support.

When my device is registered for MAM, what can the University see on my device?

Your organization can't see:

Calling and web browsing history
Email and text messages
Contacts
Calendar
Passwords
Pictures, including what's in the photos app or camera roll
Files

On corporate-owned Android devices with a work profile LJMU can also see:

Apps and data in your personal profile
Phone number

Your organization can always see:

Device owner
Device name
Device serial number
Device model, such as Google Pixel
Device manufacturer, such as Microsoft
Operating system and version, such as iOS 12.0.1
Device IMEI
App inventory and app names, such as Microsoft Word

On personal devices, your organization can only see your managed app inventory, which includes work and school apps.

On corporate-owned devices, your organization can see all apps installed on the device.

On corporate-owned devices with a work profile, which is limited to Android devices, your organization can only see the apps installed in your work profile.