XenMobile 8.6 released

XenMobile 8.6

Citrix has released their latest version of their Enterprise Mobile Device Management software, XenMobile 8.6.

The upgrade, now integrates more tightly into Citrix’s GoToMeeting web-hosted video conferencing, and also with its ShareFile and GoToAssist cloud-based IT admin controls.

With the new one-touch feature, users can automatically launch and join an online meeting — using Citrix GoToMeeting or other meeting services — directly from their calendars. Or a dial-in option can be used to auto-dial the conference number and participant code for mobile users.

Also, Citrix is now offering a new multi-site support infrastructure that includes global load-balancing. The XenMobile upgrade allows businesses to quickly mobilize remote offices by using Citrix cloud servers in their geographic region to bring new business units or subsidiaries of acquired companies online with multi-domain support.

What’s New in XenMobile

  • AppController 8.6

  • Mobile Users Can Do More in Less Time – New enhancements to email and calendar make every day tasks easier and faster for mobile users. With the new one touch feature, users can automatically launch and join an online meeting, using Citrix GoToMeeting® or other meeting services, directly from their calendar. Or the dial in option auto-dials the conference number and participant code – perfect for users on-the-run.

    This highlights the strength of combining XenMobile with Citrix Worx Mobile Apps. By integrating GoToMeetingCitrix ShareFile® and Citrix GoToAssist®, XenMobile uniquely delivers tightly integrated and enhanced management, access, security and support. Organizations can also select more than 100 third party Worx-enabled applications to further improve user productivity.


  • Mobile Users Can Access Work Faster – Fast authentication enables mobile users to access work applications with a simple PIN. Similar to an ATM PIN number, this eliminates the need to type cumbersome passwords for each app. These PINs are combined with user specific digital certificates to ensure high security. Security is made both invisible and seamless, enabling doctors at a hospital, or an executive at an airport, to quickly and securely access their apps and resources by entering a single PIN.


  • Businesses Can Respond Faster and Scale Up to Hundreds of Thousands of Devices – XenMobile allows IT to quickly mobilize users with single step device enrollments, auto configuration of secure email, and wizards based deployment. This easy process provides a quicker path to productivity for users while reducing support calls to the help desk.

The following are the main new features in the 8.6 version of XenMobile.

App Controller

App Controller 2.9 contains the following new features:

  • Client certificate authentication for SSO to HDX apps. App Controller now accepts client certificates for authentication through NetScaler Gateway so users can access HDX apps by using single sign-on.
  • Multiple Active Directory domains. You can map multiple Active Directory domains in App Controller 2.9. You configure the initial Active Directory domain during the First-time Use configuration. Then, you can configure additional domains.
  • Multiple beacons for Citrix Receiver. Receiver uses beacons to determine whether users are connected to internal or public networks to then determine the appropriate connection method. You can now configure internal and external beacons in App Controller 2.9.
  • Multiple NetScaler Gateway appliances. You can configure more than one NetScaler Gateway appliance in App Controller 2.9. You can then enable the default appliance or another NetScaler Gateway appliance to act as a proxy for remote user connections. You can also configure an app hosted in the internal network to require the connection to route through a particular NetScaler Gateway appliance.
  • Native IPA and APK files. You can now upload native, IPA and APK files to App Controller 2.9 for publication to Worx Home and the Worx Store.
  • Paid apps. If users click an app in the Worx Store that requires payment, the Apple store or Google Play store opens depending on the app type.
  • Restoring saved network settings. When you use the App Controller 2.9 snapshot feature to restore your configuration settings, when you import a saved snapshot, you can import the network settings from the earlier configuration.
  • Step-up authentication policy. You can configure a policy for an MDX app to specify that users authenticate through a particular NetScaler Gateway appliance before they open the app. In doing so, users are asked to enter additional credentials, such as an RSA token.

NetScaler Gateway

To use the following features, you must install NetScaler Gateway 10.1, Build 120.1316.e:

  • Advanced endpoint analyis. NetScaler Gateway contains built-in scans for a wide variety of applications and services with the Endpoint Analysis Plug-in.
  • Client certificate authentication for Mac OS X and Worx Home. NetScaler Gateway supports client certificate authentication for Mac OS X computers. When users log on with the NetScaler Gateway Plug-in for Mac, they can choose from a list of client certificates for authentication. If the certificate is accepted, they can then save the certificate to use in future sessions. This way, the next time users log on, NetScaler Gateway uses the same certificate and users do not receive another prompt for the certificate.
  • Client certificate authentication for Worx Home. Worx Home can use client certificates to authenticate users when they log on. User devices must enroll in Device Manager. When the device enrolls, Device Manager sends the client certificate to the user device and the certificate is stored in Worx Home. When users log on, NetScaler Gateway requests the client certificate and authenticates the user.
  • Device certificates. You can install PKCS#12 certificates on NetScaler Gateway. Device certificates support Windows-based and Mac OS X computers. Device certificates also work with endpoint analysis.
  • Kerberos Constrained Delegation (KCD). You can configure KCD support on NetScaler Gateway virtual servers. This feature provides single sign-on to Kerberos-based applications.
  • NetScaler Gateway Plug-in support. The NetScaler Gateway Plug-in runs on Windows 8.1 and Mac OS X Version 10.9.
  • Proxy support. NetScaler Gateway supports a traffic policy-based proxy configuration that facilitates seamless redirection of secure (HTTPS) and unsecure (HTTP) network traffic from WorxWeb to proxy servers in your network.
  • ShareFile Setup Wizard. This wizard allows you to configure secure access to your ShareFile Storage Zone controllers that reside in the internal network.
  • XenMobile Deployment Page. NetScaler Gateway supports a consolidated XenMobile deployment page that allows you to configure a XenMobile deployment from a single page.

Device Manager

Device Manager 8.6 provides the following new features:

  • Client certificate authentication. Users can now authenticate their devices to XenMobile using client certificates, giving administrators the choice of authenticating their users using Active Directory credentials or client certificates. By using client certificates, users will only need to use their own chosen PIN number to log in to any of the Worx-enabled apps.
  • MDM policy support for iOS 7. XenMobile 8.6 now provides support for iOS 7 MDM policies, which includes such key capabilities as Per-App VPN, OpenIn document controls, Enterprise SSO (Kerberos) Account, Silent Install/Uninstall, AirPrint and AirPlay, Font, Web Content Filters, Personal Hotspot restrictions, Organization Info, and more.
  • VPP support for iOS 7. This release supports Apple’s Volume Purchase Program (VPP) for bulk purchased of iOS 7 apps. With this version, al apps purchased through VPP only require a single license code.
  • Worx Home on Amazon Kindle MDM policies. You can now use the following new MDM policies on Worx Home for Amazon Kindle:
    • App uninstall restriction. You can define a list of apps that you do not want a user to uninstall. You can also specify a list of apps that a user can uninstall.
    • Amazon Kindle restrictions policy. This policy allows you to apply certain security restrictions for your Worx Home for Kindle users, such as the ability to allow or disallow non Amazon apps to be installed, device factory reset, social networks, cellular networks, and more.
  • Samsung Knox Support. This release of XenMobile 8.6 supports the ability to enable and manage the Samsung Knox Container on Samsung Knox Devices (Samsung S4 devices that support the Knox API version 1.0). Your MDM administrator has the ability to instantiate the Samsung Knox Container by deploying the following XenMobile MDM Policies:
    • Exchange ActiveSync Configuration. Allows you to remotely configure Exchange Email settings, such as server configuration and advanced mail server settings (SSL, synchronize contacts, synchronize calendar, make default email account).
    • Password Policy. Provides the ability to configure device passcode for the Knox container, to meet the standards of your IT department.
    • Unlock and Reset Passcode. The administrator can also remotely unlock and reset the contain passcode.
    • Browser Configuration. Allows you to control behavior of the Knox browser on the device, such as blocking the browser, enable or disable JavaScript, disable cookies or pops ups, disable auto-fill, and force fraud warning.
    • Enterprise VPN. Configure corporate VPN settings so apps launched from inside the Knox secure container (such as the browser) use a secure connection.
    • App Restriction. Configure app blacklists to block apps from being installed in the Knox Container.
    • Remote Wipe of Knox Container. Selective wipe all apps and content from the Knox Container.
    • App Uninstall. Ability to preform silent app removal from the Knox Container.
    • App Install. Ability to deploy Samsung Knox apps to the Knox Container.
  • Geo-fencing on Android. Now, MDM geo-fencing capabilities for devices are available on the Android platform. Geo-fencing features include:
    • Geo-fencing. Allows you to define a geographic perimeter for an Android device and then choose to perform a selective or full wipe upon perimeter breach set. You have the option of setting a delay before the device is wiped, which gives the user time to return to the allowed GPS location perimeter.
    • Geo-tracking. Provides the ability to view the locations of a device and to track its locations an device over periods of up to six hours at a time.
  • Symantec PKI. XenMobile 8.6 now supports Symantec PKI.
  • XenMobile Mail Manager (XMM) – Supported on Exchange 2013. XMM now supports Microsoft Exchange 2013.

MDX Toolkit

You can configure the following new policies in MDX mobile apps that you create with the MDX Toolkit.

For both iOS and Android apps, you can:

  • Provide a NetScaler Gateway address to specify an alternate gateway to be used for stronger authentication.
  • Specify the preferred micro VPN connection mode – secure browse (reverse web proxy) or full VPN tunnel – to use depending on the authentication type that users encounter.
  • Intercept and redirect system or console logs from an app to the Worx app diagnostic facility.

For iOS apps exclusively, you can:

  • Prevent an app from using dictation services.
  • Prevent an app from using AirDrop.
  • Prohibit an app from using the Worx diagnostic logging facility.

For Android apps exclusively, you can:

  • Determine exclusions to the types of documents that can be exchanged between the app and other apps.
  • Specify an encryption version to be used for public and private file encryption.
  • Specify a label to identity the specific certificate required for an app for use with a public key infrastructure (PKI).
  • Enable Kerberos, client certificate authentication.

For Worx apps, you can:

  • Prevent an app from using the Worx app diagnostic logging facility to record and collect logs with the Worx Home email support feature.
  • Determine if the Worx app diagnostic logging facilities use either the file, console, or both output mediums.
  • Set the level of logging ranging from logging no information to logging detailed informational messages.
  • Set a limit for the number of log files that the Worx app diagnostic logging facility keeps before rolling over.
  • Limit the size in megabytes of the log files that the Worx app diagnostic logging facility keeps before rolling over.

For WorxMail exclusively, you can:

  • Enable or prevent a one-way synchronization of WorxMail contacts to a device and the sharing of WorxMail contacts as vCards.
  • Enable WorxMail to accept all SSL certificates, valid or not, and allow access, or you can make sure WorxMail blocks access when a certificate error appears.
  • Enable WorxMail to support Exchange Information Rights Management (IRM) capabilities, which allows a sender to prevent recipients from forwarding, modifying, printing, faxing, saving, or cutting and pasting the message content.

For WorxWeb exclusively, you can:

  • Determine if WorxWeb users can view but cannot edit the browser address field, or you can hide the address bar completely. You can also hide the entire toolbar.
  • Enable WorxWeb to filter web links by configuring a list of allowed or blocked sites.
  • Provide a list of preloaded bookmarks that include a folder name, friendly name, and web address.

Worx Apps

The following are new features for Worx Apps.

Worx Home:

  • Worx Home is supported on iOS 7.
  • Worx Home supports enrollment. You no longer need a separate app (Citrix Mobile Enroll) to enroll devices into XenMobile. Now, iOS users can enroll using Worx Home and gain access to all of their apps, documents, and support features.
  • Single step simplified enrollment for iOS. The enrollment process has been simplified into a single step. After logging on with your network credentials, you only need to perform a single step to enroll your device.
  • Ability to refresh Worx Store. You can now refresh the Worx Store on Worx Home and see any app updates provided by your administrator.
  • Enhanced auto-discovery for easier enrollment. Worx Home enrollment now supports two types of auto-discovery, so a user can enter either their corporate email address (such as, user.name@work.com) or their UPN name (username@companydomain) and enroll through auto-discovery.
  • Client certificate authentication. This release of Worx Home supports client certificate authentication (in addition to Active Directory-based authentication). You configure client certificate authentication on NetScaler Gateway. When users log on, NetScaler Gateway sends the client certificate to the user device.

WorxMail 1.3

  • WorxMail is supported on iOS 7.
  • Out of Office Support. You can now set your own custom Out of Office replies from WorxMail.
  • ActiveSync policy support. WorxMail 1.3 now supports several ActiveSync policies for iOS and Android.
  • ShareFile single sign-on. No need to log on to ShareFile more than once.
  • Client certificates. No need to enter Active Directory credentials more than once.
  • Multi-select. You can now multi-select emails for mass delete operations.
  • Export WorxMail contacts for Caller ID. You can now export your WorxMail contacts to your iPhone or Android devices so those contacts can be seen in Caller ID.
  • Support for Office 365 Exchange.
  • Picture attachments on emails. You can now access your device’s pictures and send them as WorxMail email attachments.
  • Sending files to WorxMail from MDX apps. You can securely send file attachments that originate from MDX-enabled apps, such as files from WorxWeb, ShareFile, and more.
  • Join GoToMeeting directly from calendar invites. With the WorxMail Fast Join feature, you can now dial directly into a GoToMeeting conference from the WorxMail calendar invite.
  • Conversation view. You can sort your Inbox emails by conversation, or you can choose to view your emails chronologically, in a flat list.
  • Support for emails as attachments – (.msg and .eml files).
  • Information Rights Management (IRM) on Android. Allows you to use IRM to apply persistent protection to messaging content, and allows mobile device users to be able to create and consume IRM-protected content.

TO Download and learn more click here