Server Infrastructure Roles in MDM

Article
02/10/2009

2/9/2009

System Center Mobile Device Manager uses role-based access control. Unlike an authentication system that specifies who a user is, role-based access is an authorization system that specifies what a user is authorized to access and what tasks that person can perform.

The following shows the server infrastructure roles:

DeviceManagementServers
EnrollmentServers
SelfService

These roles are represented through MDM infrastructure groups that the Active Directory Configuration Tool (ADConfig) creates. For more information about these groups, see ADConfig Tool.

Tasks by Infrastructure Role

The following shows the tasks that each infrastructure role gives users.

DeviceManagementServers

The DeviceManagementServers role is represented through the SCMDMDeviceManagementServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the DeviceManagementServers role can perform.

Cmdlet	Task
Add-BlockedDevice	Add a compromised managed Windows Mobile device to the blocked device table.
Get-MDMCurrentInstance	Return an MDMInstance object that represents the instance that the current MDM Shell is managing.
Get-MDMInstance	Return an MDMInstance object that represents the MDM instances in an organization.

EnrollmentServers

The EnrollmentServers role is represented through the SCMDMEnrollmentServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the EnrollmentServers role can perform.

Cmdlet	Task
Get-BlockedDevice	Return information about the current set of managed devices that are blocked.
Get-MDMCurrentInstance	Return an MDMInstance object that represents the instance that the current MDM Shell is managing.
Get-MDMInstance	Return an MDMInstance object that represents the MDM instances in an organization.

SelfService

The SelfService role is represented through the SCMDMSelfServiceServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the SelfService role can perform.

Cmdlet	Task
Get-DeviceManagementConfig	Return the current global device management configuration.
Get-EnrollmentConfig	Return the current configuration of the Enrollment service.
Get-EnrollmentRequest	Return pending managed device enrollment requests.
Get-MDMCurrentInstance	Return an MDMInstance object that represents the instance that the current MDM Shell is managing.
Get-MDMDevice	Return information about devices that MDM manages.
Get-MDMDeviceStatus	Return status information for the specified managed device.
Get-MDMGlobalGatewayConfig	Return the global virtual private network (VPN) settings shared among all computers that are running MDM Gateway Server.
Get-MDMInstance	Return an MDMInstance object that represents the MDM instances in an organization.
Get-MobilePolicyServiceConfig	Return the current configuration of the Group Policy service.
Get-SoftwareDistributionConfig	Return the current configuration of MDM software distribution service.
Get-WipeConfig	Return the current configuration of the wipe service.
Get-WipeRequest	Return the unprocessed wipe requests for the specified managed device.
New-EnrollmentRequest	Create a new managed device enrollment request.
New-WipeRequest	Create a new wipe request that deletes all content on the targeted managed device.
Remove-EnrollmentRequest	Remove a pending enrollment request for a managed device.
Remove-WipeRequest	Remove a wipe request for the specified managed device if the wipe request is yet unprocessed.
Set-MDMCurrentInstance	Configure the current MDM Console to manage a specific MDM instance. Note: Anyone who has access to MDM Console can run this cmdlet.

Tasks and Administrator Roles by Cmdlet

The following shows the tasks that each role can perform.

Cmdlet	Task	Required Admin Role
Add-BlockedDevice	Add a compromised managed device to the blocked device table.	DeviceManagementServers
Get-BlockedDevice	Return information about the current set of managed devices that are blocked.	EnrollmentServers
Get-DeviceManagementConfig	Return the current global device management configuration.	SelfService
Get-EnrollmentConfig	Return the current configuration of the Enrollment service.	SelfService
Get-EnrollmentRequest	Return pending managed device enrollment requests.	SelfService
Get-MDMCurrentInstance	Return an MDMInstance object that represents the instance that the current MDM Shell is managing.	DeviceManagementServers EnrollmentServers SelfService
Get-MDMDevice	Return information about managed devices that controls.	SelfService
Get-MDMDeviceStatus	Return status information for the specified managed device.	SelfService
Get-MDMGlobalGatewayConfig	Return the global virtual private network (VPN) settings shared among all computers that are running MDM Gateway Server.	SelfService
Get-MDMInstance	Return an MDMInstance object that represents the MDM instances in an organization.	DeviceManagementServers EnrollmentServers SelfService
Get-MobilePolicyServiceConfig	Return the current configuration of the Group Policy service.	SelfService
Get-SoftwareDistributionConfig	Return the current configuration of MDM software distribution service.	SelfService
Get-WipeConfig	Return the current configuration of the wipe service.	SelfService
Get-WipeRequest	Return the unprocessed wipe requests for the specified managed device.	SelfService
New-EnrollmentRequest	Create a new managed device enrollment request.	SelfService
New-WipeRequest	Create a new wipe request that deletes all content on the targeted managed device.	SelfService
Remove-EnrollmentRequest	Remove a pending enrollment request for a managed device.	SelfService
Remove-WipeRequest	Remove a wipe request for the specified managed device if the wipe request is yet unprocessed.	SelfService
Set-MDMCurrentInstance	Configure the current MDM Console to manage a specific MDM instance. Note: Anyone who has access to MDM Console can run this cmdlet.	SelfService

Server Infrastructure Roles in MDM

Tasks by Infrastructure Role

DeviceManagementServers

EnrollmentServers

SelfService

Tasks and Administrator Roles by Cmdlet

See Also

Reference

Additional resources