Strange MDM question from friend. Would appreciate suggestions.

Posted by oopspruu@reddit | sysadmin | View on Reddit | 20 comments

Hello Everyone, A friend asked me advice for MDM solution to accommodate a very specific scenario. They are primarily checking if such a solution exists in Intune. Requirement: When the device is moving or the train is moving on which the device is, , we want to block certain applications on the device and once the device comes back to stoppage or is stationary, , the apps should start working again. I must say I've never heard of such use case before and I'm lost on what to suggest. So would appreciate if anyone here has worked with such implementation.

Reply to Post

20 Comments

[-]

jpref@reddit

You can set geolocation zones and have profiles or apps sent based on that, the issue is that gps can simply be turned off by the user. You might be better off using distributions based on responses as to what access point they are on , company owned connection or falls to LTE /cell and then checks in and hides or removes apps . This is complex to get a consistent changing and if you get a weak AP and it switches back and forth you are sunk . Has never been worth dynamic ch aging apps or profiles , better to just set and forget en mass .

[-]

bm74@reddit

I think you can force GPS on via MDM too, which would negate the first issue.

[-]

jpref@reddit

Location is considered privacy settings , you cannot stop them from turning off . Only way gps stays on is lost mode on a device managed in DEP

[-]

AppIdentityGuy@reddit

I'm very confused about the reason for the requirement. I can't think of a reliable way of confirming movement?

[-]

IrishInUSA7943@reddit

Boeing infamously has a safety rule that phone usage must be done sitting/standing in one place. I think this is primarily intended towards areas where a safety hazard may be present, but they apply it equally in their offices too

[-]

levidurham@reddit

I did a job in a refinery that had a rule that if you so much glanced at your phone while walking from one building to another you would be reported and safety would come talk to you. On a personal note, despite being surrounded by oil refineries my whole life, that was the first one I worked in; but they refined byproducts of the paper pulping process.

[-]

oopspruu@reddit (OP)

I know that their organization also works for a Railway company, so maybe that's why they specified trains. I'm also in the same boat and confused what solution would detect movements.

[-]

RCTID1975@reddit

> what solution would detect movements. GPS? It's all about scale and tolerances. Since we're talking trains here, it seems like GPS would be reliable. Now how you would incorporate that into what you want to do is an entirely different question.

[-]

ahazuarus@reddit

What a dubious requirement. Anything that accomplish this would be janky as hell no matter what.

[-]

oopspruu@reddit (OP)

I agree 💯

[-]

Unable-Board-5255@reddit

You can try [Scalefusion](https://scalefusion.com/windows-mdm-solution?utm_campaign=Scalefusion%20Promotion&utm_source=Reddit&utm_medium=social&utm_term=CM), It is compatible with windows, Linux, Mac, iOS and Android. And Conditional access can be done, am not sure about the movement tracking but I think it also can be done through scripting.

[-]

Playful_Mountain5140@reddit

While your question specifically mentions Intune, it's worth noting that other Mobile Device Management (MDM) solutions, including third-party ones, might also offer similar capabilities. For instance, you could explore solutions like [Scalefusion](https://scalefusion.com/mobile-device-management?utm_campaign=Scalefusion%20Promotion&utm_source=qoura&utm_medium=social&utm_term=VM) that cater to specific use cases and might have features to control app access based on device movement and location.

[-]

kpwde@reddit

WorkspaceONE supports Windows, macOS, Linux, iOS, Android, POS systems, and more. Also supports features such as geographical actions, conditions, etc, it might be worth checking it out.

[-]

malikto44@reddit

The only way I can see that being done is to have that custom programmed, and the program installed via the MDM. I've never heard of a use case like that, and it will take a lot of custom geofencing.

[-]

Wild_Snow_2632@reddit

I've seen a similar product. Pcs on a forklift. When the forkliift is in motion \[product I don't remember\] would disable the screen so there wouldn't be distracted driving.

[-]

colej2010@reddit

I don't think you're going to get that in Intune. In order for any of that to work the computer would need an accelerometer and some software component to enable active monitoring of it. Then you'd need something to look at those outputs and take actions on them. And on top of it all the software would have to be able to do its thing without an active internet connection. I'd be interested in what the use case is.

[-]

OmnipotentBork@reddit

i havent seen anything that will work based on the device in movement, Geo fencing would work but you can setup specific site for the app to work at. but it blocks it everywhere outside of the Geo fence, also is site based and does not care about device in motion. so is it the motion that has to be nixed or unauthorized access from outside of an area?

[-]

RandomName1986@reddit

I feel like there has to be a solution for if someone is driving. I think if you look into an MDM solution that blocks app access while they're driving, you'll find more success.

[-]

bofh2023@reddit

I'd be very surprised if this was something you could nail down with an MDM. More of a thing the APP should do in it's main loop: "is location mostly the same as it was 1 second ago? Yes? Carry on. No? Lock down until and recheck in a second."

[-]

oopspruu@reddit (OP)

Yeah that's where I am at currently. I don't this is doable with a commercially viable MDM solution. They are on Intune and I am 80% sure Intune or Azure AD doesn't have any such conditional access