Deployment on managed devices (MDM)

You can deploy the Threema Work app manually or by using an MDM or EMM system:

1. Manual deployment: unmanaged devices (without MDM)
   Manual deployment is straightforward. After the users have downloaded the free Threema Work app from the appropriate app store, they enter the credentials you have provided, and the app is ready for use. Learn more…
2. Deployment via MDM system
   If you deploy the Threema Work app via MDM system, the credentials for the app’s activation are provided by the MDM system. The setup process can also be completed automatically using configuration parameters. Learn more…

Watch our product demo to learn how to deploy the Threema Work app to your users and to get an overview of the management cockpit.

You can preconfigure the Threema Work app for your users and set it up as desired so that the app is ready for use when first launched. The preconfiguration can be carried out using either a regular MDM system or the app configuration in the management cockpit. The app configuration is typically used for personal or unmanaged devices.

With global settings, you can preconfigure the app for all users in the same way.

Individual settings allow you to define exceptions from the global settings for each user.

Try it with this instruction, or get an overview of the available configuration settings in our product demo.

Threema Work is compatible with any MDM system that supports Android Enterprise (Android) and Managed App Configuration (iOS). Many developers of such MDM systems are part of the AppConfig Community. Threema Work is compatible with MobileIron, Sophos Mobile, Citrix XenMobile, SAP Afaria, VMware AirWatch, and others.

The following step-by-step instructions for deploying Threema Work are available:

• Deployment using Sophos Mobile
• Deployment using Citrix XenMobile

Other MDM systems: Please make sure that your MDM system supports Android Enterprise (Android) and Managed App Configuration (iOS).

When configuring the Threema Work app with MS Intune, certain token types from Intune are available. According to Microsoft, the following token types can currently be used to configure the Threema Work app:

• {{userprincipalname}}, e.g., john@contoso.com
• {{mail}}, e.g., john@contoso.com
• {{partialupn}}, e.g., John
• {{accountid}}, e.g., fc0dc142-71d8-4b12-bbea-bae2a8514c81
• {{userid}}, e.g., 3ec2c00f-b125-4519-acf0-302ac3761822
• {{username}}, e.g., John Doe
• {{PrimarySMTPAddress}}, e.g., testuser@ad.domain.com

Other custom key/value pairs are not supported.

With Android Enterprise, it is generally possible to distribute the app in a container. iOS does not have a standardized type of container supported by the operating system.

However, Threema Work is not available as a wrapped container solution (e.g., for MobileIron AppConnect or Citrix MDX Toolkit). Wrapping would require substantial adjustments to the Threema Work app that would lead to considerable limitations and incompatibilities. Since our requirements in regard to ease of use and reliability could not be met, wrapping is not supported.

If your company uses MobileIron AppConnect, please refer to this article.

Threema Work supports Android Enterprise (formerly known as Android for Work). For technical reasons, MobileIron AppConnect and Android Enterprise can’t be used at the same time.

However, the app configuration in the management cockpit can be used to manage the Threema Work app separately in case you use MobileIron AppConnect.

After installation, users must activate the Threema Work app once by entering their credentials (username and password).

Save users from having to type in their credentials by sending them an activation link. You can copy this link by clicking on the three dots at the end of a line in the user management overview or by clicking “Copy activation link” in a user’s detail view.

Please note:

• The Threema Work app must be installed on the device in order for the activation link to work.
• On Android, the Threema Work app must have been opened at least once in order for the activation link to work.

The activation link is structured like this:

https://work.threema.ch/license?username=somecompany&password=xxxxxxxxx

If the number of active users or devices exceeds the number of purchased licenses, users are highlighted in red in the overview. To delete unneeded users or devices, carry out the following steps:

1. Log in to the management cockpit and open the user management.
2. Select the “Issues” dropdown list. If you see the message “Licenses contain too many devices,” continue with step 3. If not, continue with step 4.
3. Click on the issue “Licenses contain too many devices” and then on a user. The section “Devices” lists the user’s devices.
   1. Assess which devices are no longer needed based on the time of the last activity and the Threema ID.
   2. Delete the unneeded device by clicking on the three dots at the end of a line. Caution: do not use the “Delete” button at the top right to avoid deleting the entire user.
   3. Return to step 2.


4. Click on the issue “Licenses missing for active users”
   1. Check the box next to the users you want to delete.
   2. Click on the “Delete” button at the bottom of the page and follow the on-screen instructions.