ENTERPRISE

MOBILITY
MANAGEMENT
Enrollment Guide for iOS Devices

Date: 1. September 2020

Version: 4.1
CONTENT
1 Introduction & Prerequisites 1

2 Enrollment of a device in the EMM-service 1

2.1 Apple DEP Enrollment 2
2.1.1 Introduction 2
2.1.2 Enroll using Apple DEP 4
2.1.3 Configure Workspace one Intelligent hub app 9
2.2 Enrollment via Workspace One Intelligent Hub App / QR Code
Enrollment 11
2.2.1 Introduction 11
2.2.2 Enroll using the workspace one intelligent hub app 13

3 E-mail configuration for Corporate e-mail 17

3.1 Native e-mail App Configuration 17
3.2 VMware Boxer App Configuration 19

4 Re-Enrollment of a device in the EMM Service 22

4.1 Re-enrollment via Hub App without device reset 22
4.2 Re-enrollment after device reset to factory default 25

5 Cancellation / Removal the EMM-Service 25

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT

EMM Enrollment Guide iOS

1 Introduction & Prerequisites

This document describes in detail how to enroll iOS devices into the Lufthansa Enterprise
Mobility Management Service (EMM-Service).

For more experienced users, there is also a Quick reference guide available for the
enrollment of iOS devices. Please consult the EMM eBase page at eBase A-Z, EMM –
Enterprise Mobility Management, section Installation & User Manuals: QuickStart-Guide
iOS end device.

Before being able to enroll your device into the EMM System, it is necessary that you have
ordered the EMM-service for your device (serial number of devices is relevant) and received
the EMM Activation e-mail.

We also recommend approx. 15 minutes undisturbed time for this, as the enrollment steps
should be executed in order, without interruptions. Interrupting an enrollment can cancel
the enrollment, and it may have to be repeated from the start.

2 Enrollment of a device
in the EMM-service
There are two ways for enrolling an iOS device:

1. Apple DEP Enrollment: Enrollment integrated into the Apple device activation process
(remark: brand new device or factory reset required)
2. Enrollment via VMware Intelligent Hub (Hub App) / QR-Code Enrollment: Enrollment
with the Hub App without a device reset / only available for devices that are not part of
the LH Group Apple Device Enrollment Program (DEP)

The activation e-mail has the information what type of enrollment is possible for your
device.

IMPORTANT

Depending on the e-mail you have received please proceed with the appropriate
chapter:
2.1 Apple DEP Enrollment
or
2.2 Workspace One Intelligent Hub based Enrollment / QR Code Enrollment

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 1/25

EMM Enrollment Guide iOS

2.1 Apple DEP Enrollment

2.1.1 INTRODUCTION
The Apple Device Enrollment Program (DEP)1 provides a fast, streamlined way to enroll your
corporate-owned iOS device, whether purchased directly from Apple or through
participating Apple Authorized Resellers. Your corporate owned device will normally be
Apple DEP enabled, if you have bought it e.g. via buy:order.

The Device Enrollment Program makes it even easier for users to get set up an iOS device
and configures devices through the EMM System. You are guided through the activation
process with the in iOS built-in Setup Assistant.

To setup your device, please follow the steps in this chapter. These steps are the same for
either a new device or a device which has been reset to factory defaults.

IMPORTANT

When you enroll a device into EMM you have to accept the Terms of Use for EMM.
During an Apple DEP enrollment, the Lufthansa Terms of Use cannot be displayed
therefore please consult the EMM eBase page at eBase A-Z, EMM – Enterprise
Mobility Management, section Terms of Use to make yourself familiar with the
applicable Terms of Use. With entering your User-ID and password during the
enrollment-process you accept the Terms of Use defined by Lufthansa for this EMM
Service.
When you have enrolled your device, you also have an overview in the User Self Service
Portal about the Terms of use: https://emm.app.lufthansa.com/MyDevice

For Apple DEP devices there is no longer the need to configure an Apple ID. All Apps
provided in the EMM Store can be installed without an Apple ID2.

If you want to install public Apps for private use from the Apple Store, you have to
configure/create an Apple ID. For further instructions how to do this, please consult the
information at: https://support.apple.com/en-us/HT203993

1
For more information about the Apple DEP and mobile devices, please refer to the EMM eBase page.
2
Except some few apps, that are not free of charge, like Good Reader, Good Notes, Notability, PDF Expert. / currently also only valid
for Lufthansa users and not Swiss users.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 2/25

EMM Enrollment Guide iOS

SAMPLE OF DEP ENROLLMENT E-MAIL

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 3/25

EMM Enrollment Guide iOS

2.1.2 ENROLL USING APPLE DEP

The enrollment of your device with the Apple Device Enrollment Program (DEP) is part of
the initial Apple device activation.

a) If your device is brand new and has not been used before, just switch it on and
follow the Apple activation screens.
b) If your device has been used before, please reset your device (“factory reset”), in
order to activate the DEP enrollment.

01 02 03
Press home to open Select your Language Select your Country or
Region

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 4/25

 EMM Enrollment Guide iOS

04 05 06
Press Set Up Manually You can customize your Select a Wi-Fi network
settings and press or use the 3G/LTE
Continue mobile connection

07
Login into “LH_Corporate_WLAN_mobile” Wifi with your U-number and eBase password.
Login into “Smartnet” Wifi with your A0-number and AD-password.
Login into “swiss” Wifi with your 4-Letter Code and AD-password.
Also, please trust the shown certificate in the second step.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 5/25

EMM Enrollment Guide iOS

IMPORTANT

In order to successfully enroll your device within an internet connection, please ensure
that the device is connected to one of the three Wi-Fi connection above (if available).
Alternatively, you can continue choosing 3G/LTE mobile network or any public or private
Wi-Fi, which has direct access to the internet.

08 09
This Icon will appear when Use your desired option to
Apple feature asks you to either restore or set up as
use your personal new IPhone
information, press Continue

IMPORTANT

If you restore your Apple DEP device from a backup, please keep in mind to DELETE the
Hub App after your device restarted and REINSTALL the Hub App from the EMM
Store.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 6/25

 EMM Enrollment Guide iOS

10 11

Tap on Next and the IPhone is configuring. If the Enter your U-Number and eBase password /
“Remote Management” screen does not appear, Austrian-users A0-Number and AD-password /
please contact UHD1 for further information. Swiss-users 4-Letter-Code and AD-password

12 13 14
Click on Continue to Create a complex Passcode: at Re-enter your
setup Touch ID or select least 8 characters2 passcode
Set Up Touch ID Later
1
UHD (User Help Desk) Tel: +49 69 696 20331, E-Mail: [email protected]

2
Allowed are only the following letters, numbers and special characters:
A…Z a…z 0…9 . , + * - / # = $ % ( ) ! ; : _ < >
LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 7/25
 EMM Enrollment Guide iOS

15 16 17
Click Continue to allow Click on Continue to receive If you would like to use location
installing updates iMessages & FaceTime calls services, please click on Enable
automatically on all your devices. If you do Location Services, otherwise
not allow this then click Not tap on Disable Location
Now. Services.

18 19 20
If you would like to receive You can choose between Your device is now
weekly Screen Time reports the Light and the Dark successfully activated
then click on Continue, else Set mode of your device & enrolled
Up Later in Settings

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 8/25

EMM Enrollment Guide iOS

Your device is
successful configured!

IMPORTANT

For future use of your device within Lufthansa Group locations, please ensure to be either
connected via 3G/LTE or to the Lufthansa corporate Wi-Fi “LH_Corporate_WLAN_mobile”
(login with your user credentials U-Number and your eBase password). Connected to other
Lufthansa corporate Wi-Fi like “Z6sl4b2aniF5wa1u9Uy3” or “LH_Corporate_WLAN” will
limit the functionality of your mobile device and will cause problems while using the EMM
Service or your device. Therefore: please do not use these Wifi networks.
Outside of Lufthansa Group locations you can use any Wi-Fi with your device (public or
private), that has direct access to the internet.
For Austrian employees please use the “Smartnet” Wi-Fi connection (login with your
A0xxxxx number and your password).
For Swiss employees please use the “swiss” Wi-Fi connection (login with your 4-Letter-
Code and your AD password).

2.1.3 CONFIGURE WORKSPACE ONE INTELLIGENT HUB

APP
Continue the setup of the Hub App. The Hub App will be pushed automatically to your
device. Please note: It may take a moment (1-2 minutes) until the Hub App automatically
gets installed on your device. In order to configure it, please proceed with the following
steps.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 9/25

EMM Enrollment Guide iOS

1 2 3
Tap on Hub on the Tap on I understand to Tap on Not now
device’s home screen continue

4 5 6
Tap on Allow to allow To show your device This screen shows your
the Hub App to send status tap on This successful enrolled
you notifications Device and compliant device

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 10/25

EMM Enrollment Guide iOS

Your device is
successful configured!

2.2 Enrollment via Workspace One Intelligent Hub App

/ QR Code Enrollment

2.2.1 INTRODUCTION
Please note

You must have an Apple ID to continue (If you don’t have one, proceed to
https://appleid.apple.com/ and create an Apple ID or see the user guide for getting an Apple
ID at the EMM eBase page (eBase A-Z, EMM – Enterprise Mobility Management, section
Installation manuals)

Remark

Enrollment with the Workspace One Intelligent Hub App/ QR Code Enrollment is as initial
enrollment only provided for users whose device is not registered at the LH Group Apple
DEP.

Enrollment with the Hub App / QR code-based enrollment is for enrolling your iOS device
into the EMM System, if the device is not registered with the LH Group Apple DEP. This
method can also be used for re-enrollments of Apple DEP devices, if the initial enrollment
was done with Apple DEP (see chapter Error! Reference source not found.). The e
nrollment is based on an activation e-mail, which is sent to you and contains the enrollment
information and a QR code.

This is a sample of an ENROLLMENT e-mail for QR Code Enrollment via Workspace One
Intelligent Hub App:

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 11/25

EMM Enrollment Guide iOS

Dear Max Mustermann,

Your device (with serial number FL2123GHX34LY) has been approved for the EMM-Service and can
now be enrolled in the Lufthansa EMM-service via Workspace One Intelligent Hub.

If you are familiar with the Enrollment, you can start by downloading the Intelligent Hub from the
Apple App Store, start the Hub App and scan the QR Code.

QR Code for Enrollment with Workspace One Intelligent Hub App:

Instead of the QR Code you can also use Server name and GroupID to enroll your device with the
Workspace One Intelligent Hub App:
Server: emm.app.lufthansa.com
Group ID: LHCOPE

When the Hub App prompts you for a username and password during enrollment, please use:
Username: UserID
Password: eBase Password

If you need additional help, we have created two different Enrollment Guides to support you:
 Detailed Enrollment Guide which explains everything step by step
 QuickStart Enrollment Guide for experienced users giving only the most necessary
information
These Enrollment Guides can be found at eBase A-Z, EMM – Enterprise Mobility Management,
section Installation- & User Manuals.

Please also get familiar with the Terms of Use for EMM. They are shown during the enrollment and
can also be found at eBase A-Z, EMM – Enterprise Mobility Management, section Terms of Use for
your ordered product.

After a successful enrollment you can manage your device using the User Self Service Portal. In
order to use and sign-in to the Self Service Portal please use these information:
Self Service Portal: https://emm.app.lufthansa.com/MyDevice
Group ID: LHCOPE
Username: UserID
Password: eBase Password

Please keep this mail for your records as it contains data which could be helpful for later use.

If you have any questions / issues with the enrollment, please contact the IBM User Help Desk: emm-
[email protected]

Regards,
Your EMM Operations Team

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 12/25

EMM Enrollment Guide iOS

Remark

Please note: Keep the enrollment Mail in your records, since it allows you to re-enroll your
device as many times as necessary.
The Group ID is also necessary if you want to Login to the User Self Service Portal at
https://emm.app.lufthansa.com/MyDevice.

2.2.2 ENROLL USING THE WORKSPACE ONE

INTELLIGENT HUB APP
To enroll your device into the EMM System, please follow the steps below.

1 2 3
Open the Apple App Now you can select Open the Activation
Store and download QR Code to scan the E-mail on your
the Intelligent Hub Code on your Laptop and scan the
App Activation E-mail. QR Code

Important

For Enrollment please use the QR Code authentication method. If you cannot access the QR code, you can also
enter the Server Details. The relevant values can be found in the EMM Activation e-mail. Entering your E-mail
Address in the field will not work.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 13/25

EMM Enrollment Guide iOS

4 5 6
Type in your U-Number and Click on Next Click on Allow to
eBase password / Austrian- receive Notifications
users A0-Number and
password / Swiss-users
enter 4-Letter-Code and
AD-password

7 8 9
Click on Allow to Tap on Close, press Tap on Profile
continue the Home Button and Downloaded to
open Settings continue

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 14/25

EMM Enrollment Guide iOS

10 11 12
Tap on Install to Enter your device Tap on Install
continue passcode, which you use
to unlock your device

13 14 15
Tap on Install Tap on Trust Tap on Done

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 15/25

EMM Enrollment Guide iOS

16 17 18
Switch back to Hub App opens and This screen show your
Safari and choose shows the enrolled successful enrolled
Open device. To show your and compliant
device status tap on device.
This Device

Your device is
successful configured!
IMPORTANT

For future use of your device within Lufthansa Group locations, please ensure to be either
connected via 3G/LTE or to the Lufthansa corporate Wi-Fi “LH_Corporate_WLAN_mobile”
(login with your user credentials U-Number and your eBase password). Connected to other
Lufthansa corporate Wi-Fi like “Z6sl4b2aniF5wa1u9Uy3” or “LH_Corporate_WLAN” will
limit the functionality of your mobile device and will cause problems while using the EMM
Service or your device. Therefore: please do not use these Wifi networks.
Outside of Lufthansa Group locations you can use any Wi-Fi with your device (public or
private), that has direct access to the internet.
For Austrian employees please use the “Smartnet” Wi-Fi connection (login with your
A0xxxxx number and your password). For Swiss employees please use the “swiss” Wi-Fi
connection (login with your 4-Letter-Code and your AD password).

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 16/25

EMM Enrollment Guide iOS

3 E-mail configuration for Corporate e-mail

Corporate e-mails can be accessed via

 Native Mail App (“Mail”)

 VMware Boxer App (“Boxer”)

Before configuring the native Mail App with the EMM environment, it is necessary to meet
these requirements:
 Stable network connection (3G/LTE or Wi-Fi)
 Compliant device and enrolled into EMM System
 Existing mailBase mailbox

3.1 Native e-mail App Configuration

The native Mail App for corporate e-mail is only available for the following EMM-products:

 Business meets Private (COPE)

 Business meets Developer (CODE)
 Business shared Device / anonymous user (with team-mailboxes only) (COSA)
The default e-mail client for Business meets Private (COPE) and Business meets Developer
(CODE) users is the native mail client on your iOS device. Continue the setup following
these configuration screens.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 17/25

EMM Enrollment Guide iOS

1 2 3

After the enrollment Click on your account Click on Re-enter Password

of your device, this
window pops up.
Please click on Edit
Settings.

4 5 6
Type in your e-mail Click on Continue Now your e-mail
address and address will be
password displayed at Account

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 18/25

EMM Enrollment Guide iOS

Your device is
successful configured!
Synchronizing your
mails will take a few
minutes
Important

If you receive the error “Cannot Get Mail – The connection to server failed” after entering
your eBase password, please be patient and leave the Mail app finalizing its
configuration. This error can be ignored and will disappear as soon as the first e-mails arrive
in your Mail app.

3.2 VMware Boxer App Configuration

The VMware Boxer App is available for all EMM-products and is capable to PKI sign/encrypt
e-mails.

The VMware Boxer can be downloaded from the EMM AppStore. Use these steps to setup
and configure the application:

1 2 3
Open EMM App Store Click on Install next to Confirm Install
Boxer – Workspace One

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 19/25

EMM Enrollment Guide iOS

4 5 6
After installation has Tap on I understand Tap on Not Now
finished tap on Boxer to continue
to start the App

7 8 9

Tap on Don’t send Your e-mail address You will be redirected to

appears and then the Microsoft website
tap on SIGN IN where you have to select
an account.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 20/25

EMM Enrollment Guide iOS

10 11 12
Enter your Tap on Continue Tap on Don’t Allow since
password and click will only access your
on Sign In native business calendar
and double meetings in
Boxer

Your device is
successful configured!

13 14
Tap on Don’t Allow since Tap an Allow and
will only access your native your E-Mails will sync
business contacts and in the next minutes
double contacts in Boxer

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 21/25

EMM Enrollment Guide iOS

Important

You can configure the Boxer App to your individual needs via the settings menu in the
App.
Please also consult the detailed iOS Boxer App User Guide and (for the use of
encrypted/signed e-mails) the PKI Installation Guide. Both guides can be found at eBase A-
Z, EMM – Enterprise Mobility Management, section Installation manuals.

4 Re-Enrollment of a device in the EMM

Service
In certain circumstances, it could happen that you need to re-enroll your device. This could
occur if:

 Your device was reset to factory defaults

 Your device has been un-enrolled automatically from the EMM-service due to any
compliance violation (e.g. blacklisted app installed)
 You EMM Service is not working properly anymore

Remark

Normally you are able to re-enroll your device, without contacting the EMM Helpdesk. If you
nevertheless run into any issues while re-enrolling, please contact the User-Help-Desk.

Important

Re-Enrollment of devices is only possible, if you re-enroll the same device with the same
UserID into the same EMM product. New devices (= new serial number) always need to be
registered in the EMM system, therefore you always need to order the EMM service with the
new serial number of the device.

4.1 Re-enrollment via Hub App without device reset

If your EMM services are not working properly anymore you can re-enroll your device by
using the Hub App, no matter which procedure you used on the initial enrollment.

If your device is still enrolled, your need to un-enroll it first. To un-enroll a device from the
EMM System please go to the EMM Self-Service-Portal and use the “Enterprise Wipe”
function.

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 22/25

EMM Enrollment Guide iOS

Important: Backup the data of your device …

... before you do an Enterprise Wipe/un-enrollement. If you have data/documents stored

locally on the device in certain Enterprise Apps which were installed from the EMM App
Store (e.g. GoodReader, Notability, GoodNotes, PDF Expert), please ensure to backup this
data before performing an Enterprise wipe. The Enterprise wipe will erase all corporate apps
and data stored (locally on the device) in these Apps. Data stored in Enterprise Apps is also
not being saved while performing an iCloud or iTunes Backup.

For an enterprise wipe (= un-enrollment) of a device

1 Use a Web-browser to navigate to the EMM Self-Service Portal
Lufthansa employees Austrian employees Swiss employees
https://emm.app.lufthansa. https://myairwatch.one- https://emm.app.lufthansa.
com/mydevice intra.net/MyDevice com/mydevice

2 Enter your Group ID, Username, Password and tap on Log In

Lufthansa employees Austrian employees Swiss employees

Group ID From your Enrollment From your Enrollment From your Enrollment
email (e.g. LHCOPE) email (e.g. OSCOPE) email (e.g. LXCOPE)
Username U-number gate01⧵A0-number 4-Letter-Code
Password eBase Password AD-password AD-password

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 23/25

EMM Enrollment Guide iOS

Important

If you don’t know your Group ID anymore, you can find a How To description at eBase A-Z,
EMM – Enterprise Mobility Management, section How To.

3
Under Basic Actions tap on Enterprise Wipe
and confirm the dialogue to un-enroll your
device

Ensure that your device has Internet Access (either via 3G/LTE or WiFi), so that the devices
receives the Enterprise Wipe command. When your device is un-enrolled, the Hub App will
be changed back to un-enrolled state. Regardless which kind of device (DEP or non-DEP)
you have, you must start the Hub App and follow the instructions described in chapter
2.2.

If you don’t have an e-mail with a QR Code (due to the fact your device is a DEP device)
please use the Server Details method with the following settings:

Server URL: from the initial enrollment e-mail

GroupID: from the initial enrollment e-mail

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 24/25

EMM Enrollment Guide iOS

4.2 Re-enrollment after device reset to factory default

If your device has been reset to factory defaults and shows the Apple iOS Welcome Screen,
please follow the instructions from your initial enrollment e-mail. Step in to chapter 2 and
follow the instructions described for your mobile device model (DEP Activation or
Workspace One Intelligent Hub Activation) to re-enroll it.

5 Cancellation / Removal the EMM-

Service
To remove the EMM service from your mobile device, please order the
cancellation/cessation of the EMM-service for this device.

Info

For most users within the LH group this cancellation has to be ordered via buy:order and the
IBM-Webshop. In the IBM Webshop navigate to “Cessation” – “Cessation of Accounts”.
Here you can choose the desired serial number of the device from which the EMM service
should be removed.

After your order has been processed, the EMM service and all Enterprise content will be
removed from your device.

Important

If you e.g. just reset the device, delete the Hub App or delete the workplace profile or delete
the device in the Self-Service Portal, your device will not be fully removed from the EMM-
service. If you want to or have to remove EMM-service from a device, you have to cancel the
EMM-service for your device by an order (normally via buy:order > IBM Webshop or
buy:desk).

LUFTHANSA GROUP ENTERPRISE MOBILITY MANAGEMENT 25/25