Introduction

In this article, we will learn about auto, block and wipe inactive mobile devices in Google Workspace. Almost everyone in your organization may sign into their Google account and sync their work data on their mobile devices, Android and iOS. Your Google Admin Console > Devices > Mobile page may have hundreds or thousands of devices. Those mobile devices which do not sync for a long time (30 days or 45 days) may put your corporate data in risk. If your user lost their lost phones or they purchased a new phone, they didn't inform you for that. It opens up a security hole for unauthorized access to the corporate data on the original devices.

Inactive mobile devices in Google Workspace is a security risk
Inactive mobile devices in Google Workspace is a security risk

To mitigate the risk of data leak, there shall be an automated way to report, block and wipe these inactive mobile devices on time. Google is aware of the problem and provides some options.

With that said, certain Google Workspace editions limit these options, and the features are exclusively available on Android. The security features aren't flexible enough.

This article demonstrates how xFanatical Foresight can help you automate reporting, blocking and wiping inactive mobile devices with your needs.

Video demo

A quick demo can help you understand how it works. In the demo, we set up an automation rule that triggers for inactive mobile device of 171 days old (last sync time). [note: normally it should be a value of 30 days or 45 days]. Then the rule first retrieves the mobile device profile, blocks it from syncing, wipes its work data, and send 2 emails, one to the user of the device, and one to the admins. After we create the rule, the inactive mobile device in the list triggers the rule and is blocked and under account wiping.

Step-by-Step Instructions

  1. Sign into Foresight
  2. Go to Rules
  3. Click the new rule button button to create a new rule
  4. Select Mobile device turned inactive trigger
  5. In the Edit trigger > Mobile device turned inactive step,
    1. Sign in with Google
    2. In the Inactivity timeout option, input the exact number of inactive days after which you wish a mobile device is considered as inactive, 15 days, 30 days, 45 days, 60 days etc.
    3. Click Next
  6. Now, select the Get mobile device info action
  7. In the Edit actions > Get mobile device info step,
    1. In the Device id option, select the Device ID variable from the drop down.
    2. In the User primary email option, select the Device User Email variable from the drop down list.
    3. Click ADD NEXT ACTION
  8. Select the Block mobile device
  9. In the Edit actions > Block mobile device step,
    1. In the Device id option, select the Device ID variable from the drop down.
    2. In the User primary email option, select the Device User Email variable from the drop down list.
    3. Again, click on the ADD NEXT ACTION
  10. Select, Wipe mobile device
  11. In the Edit actions > Wipe mobile device step,
    1. In the Device id option, select the Device ID variable from the drop down.
    2. In the User primary email option, select the Device User Email variable from the drop down list.
    3. In the Device wipe type option, select Wipe an account from the device.
    4. Click ADD NEXT ACTION
  12. In the Select an action step, click the Email.
  13. In the Edit actions > Email step,
    1. In the To option, click on the icon to populate the variable drop-down menu then, Select the Device User Email variable.
    2. In the Subject option, input your subject
    3. In the Email body option, type your email template to the user on an inactive mobile device. If you need dynamic mobile device data, like the user's full name, device model, operating system, click on the v icon to populate available variables.
    4. Again, click ADD NEXT ACTION
  14. Click the Email
  15. In the Edit actions > Email step,
    1. In the To option, type administrators' emails who would receive these inactive mobile device reports.
    2. The CC and BCC options are optional. Copy to yourself if necessary.
    3. In the Subject option, input your subject
    4. In the Email body option, type your email template to the admins. If you need dynamic mobile device data, like the user's full name, device model, operating system, first sync time, last sync time, then click on the v icon to populate available variables.
  16. Click Review
  17. Give the rule a name
  18. Click Create
  19. Your rule looks like this
    A Foresight workflow to automate reporting, blocking and wiping an inactive mobile device in Google Workspace

After your rule is created, if there are mobile devices which didn't sync for exact number of days, they will trigger your rule and you will receive notifications within the Foresight app momentarily. Otherwise, you will need to wait for such events to happen in another day. For an inactive mobile device, the user on the device will be email notified, the admins will be email notified, and the mobile device will be blocked and wiped.

Notes

  • You can create different rules for different inactivity timeout days. For instance, create a 7 days inactivity rule to Email inform the user the company's mobile device policy. And create a 15 days inactivity rule to block mobile devices. If the users don't react to the warning and still do not turn on and sync their mobile devices, their mobile devices would be blocked.
  • If your rule does not trigger, one common cause is the mobile devices' last sync time is not exactly the inactivity timeout you set.
  • You can customize the rule to conditionally block or wipe inactive mobile devices using the IF action after the Get mobile device info. The Get mobile device info action outputs many variables, like Device type, Device Status, OS Security Patch Date, Brand, OS Version etc.
  • The Wipe mobile device action's Device wipe type is device-specific. Not both options are available. You're recommended to read the Google documentation Remove corporate data from a device.

Try a 14-day free trial with Foresight and manage your tasks. 

You may also like

Share on LinkedIn Share on Reddit Share on Pinterest