This guide details how administrators can configure Active Directory Mobile Authentication within the Mobile Guardian Dashboard. Configuring these settings ensures managed endpoints enforce user-level login controls and directory authentication via Active Directory or Azure AD DS.
Active Directory Mobile Connection Parameters
| Setting | Parameter / Purpose |
| Account Suffix | The domain suffix assigned to employee accounts (e.g., @company.com). |
| Base DN | The Distinguished Name path where target user accounts reside (e.g., OU=Users,DC=company,DC=com). |
| Domain Controller | The static IP address or Fully Qualified Domain Name (FQDN) of the Active Directory domain controller. |
| LDAP Port | Standard directory query port (Default: 389). |
| LDAPS Port | Encrypted directory query port (Default: 636). |
| Proxy via Mobile Guardian | When enabled, authentication requests route securely through Mobile Guardian servers rather than requiring a direct public endpoint on your internal domain controller. |
| Certificate | Upload the public CA-signed SSL certificate required to authenticate secure LDAPS connections. |
Session Management & Sign-Out Behaviors
Administrators can control session length, idle timeouts, and local security restrictions applied when an employee logs out or an authentication session expires.
Access Mobile Authentication Settings: Configuration.
- Log in to the Mobile Guardian Dashboard, navigate to Settings > Directory Settings, and select the Mobile Authentication tab.
Enter Directory Details: Directory Bind.
- Complete the server connection parameters, including Account Suffix, Base DN, Domain Controller, Ports, and Certificate upload.
Configure Time-out Parameters: Session Rules.
Define automated session limits:
- Time-out: Set the maximum duration (in minutes) an active session can remain open before forcing a re-authentication, regardless of device usage.
- Inactivity Time-out: Set the duration (in minutes) an idle device can sit inactive before automatically signing the user out.
Define Signed-Out Behaviour: Device Scope.
Select the action enforced on the device once a user signs out:
- Lock down device to Mobile Guardian login screen: Completely freezes device usage and restricts all access until a valid user authenticates.
- Display Mobile Guardian login screen and prevent browsing: Displays the login interface and blocks all web browser traffic while preserving access to native utility apps.
- Display Mobile Guardian login screen but allow browsing: Displays the login interface as an overlay without disabling open internet connectivity.
Save Configuration: Deployment.
Click Save to commit settings. Enrolled devices will apply the active login policies upon their next sync cycle.