Controll App Management - Preventing users from uninstalling the SMC App

Question

Hello, 
 I am just wondering if there is now way to prevent users from uninstalling the SMC App? 
 And as well I thought, that the compliance notification *Status Managed required* would inform administrators when the SMC App has been deleted form an Device, but it just says "Synchronization interval too large" for devices where the App has been deleted (and that could as well be the case if someone is on vacation/ill/...)? 
 Can someone help me out there? 
 Best regards, 
 Sascha

SDU · Answer

Hi all, 
 first of all, I'd like to clarify something around the management of iOS devices. 
 When you manage an iOS device there are two separate things which are involved. 
 
 The Sophos Mobile Control app This is the start of enrollment process but does not provide any management capabilities. The app is only used for the following things: 
 
 Detect jailbreak status 
 Locate the device 
 Report the device compliance status 
 Trigger device synchronization with the EMM server 
 Install apps from an Enterprise App Store 
 Display all compliance violations 
 Receive messages from the EMM server 
 Display support information

The Mobile Device Management (MDM) profile After the QR code is scanned with the app the user is asked to install the MDM profile. This profile is not directly realted to the SMC app. By installing the profiel the actual management capabilities are given such as
 
 profile installation 
 app installation 
 wiping the device 
 locking the device

Due to that, you also have two different synchronization values within the device details in the admin console called "Last MDM synchronization" and "Last SMC synchronization" If a user now removes the app, the profile still remains on the device and the device is still listed as "Managed". If an "Unenroll" action is performed from within the app, the profile is removed as well. The device then should be shown as "Unenrolled" 
 Preventing the user to uninstall the app is only possible on supervised devices by setting the restriction "Allow app removal". This however then applies to all apps. 
 Re-deploying the app will result in an unconfigured app on the device. In that case, the "Reconfigure SMC app" task must be sent out to the device. Deploying the app in a way that it is configured automatically would be a feature request which has to be raised here . 
 Hope this helps. 
 Best regards Stefan