FortiClient Android automatically managed

Forum|Forum|3 years ago
June 26, 2023
2 replies
1771 views

Hello

We have FortiClient EMS 7.0.8.

We use invitations in order to integrate Windows PCs to the EMS managed hosts.

However last time we discovered that when we install FortiClient (7.0.9) on any Android host and configure a connection to our FCT EMS, then the Android phone gets automatically managed by EMS without any invitation!

Is that behavior normal?

Then we tried to disable this unwanted behavior by enabling "Enforce invitation-only registration for ALL", but the result is that all managed hosts were ejected from managed hosts!

Is that behavior also normal?

So what is the best way to disable auto Android registration without affecting the current managed hosts.

Best answer by btan

Hello,

Assuming you did not enable 'Enforce invitation-only registration' and 'FortiClient telemetry connection key', any device will be able to join to EMS using EMS IP or FQDN.
So it is normal behavior if Android FCT join to EMS after you input EMS IP.

Then we tried to disable this unwanted behavior by enabling "Enforce invitation-only registration for ALL", but the result is that all managed hosts were ejected from managed hosts!
> This looks like a behavior for 'Enforce User Verification'
> Are you sure you enable 'Enforce invitation-only registration for ALL', and not ''Enforce User Verification'?

If you end goal is to have another level of security to join to EMS, you can use 'FortiClient telemetry connection key'.

Enabling 'Enforce invitation-only registration' meaning new devices can only join via Invitation code, and not EMS IP/FQDN.

btanAnswer

Staff & Editor

Hello,

Assuming you did not enable 'Enforce invitation-only registration' and 'FortiClient telemetry connection key', any device will be able to join to EMS using EMS IP or FQDN.
So it is normal behavior if Android FCT join to EMS after you input EMS IP.

Then we tried to disable this unwanted behavior by enabling "Enforce invitation-only registration for ALL", but the result is that all managed hosts were ejected from managed hosts!
> This looks like a behavior for 'Enforce User Verification'
> Are you sure you enable 'Enforce invitation-only registration for ALL', and not ''Enforce User Verification'?

If you end goal is to have another level of security to join to EMS, you can use 'FortiClient telemetry connection key'.

Enabling 'Enforce invitation-only registration' meaning new devices can only join via Invitation code, and not EMS IP/FQDN.

AEKAuthor

SuperUser

Thanks Bon

I confirm I've enabled 'Enforce invitation-only registration for ALL', and not ''Enforce User Verification'. I did the same test again and got same result.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO