2.1 Minimum system version

EBF Files will run on both iOS/iPadOS version 17 and above.

For Android EBF Files works on Android 14 and up.

2.2 SMB support

EBF Files support SMB2 and SMB3 protocol (SMB3.0). For SMB3, encrypted SMB communication will be used by default, if the SMB server has encryption activated.

Set-SmbServerConfiguration -EncryptData 1

To enforce encrypted communication the SMB admin must activate this setting on the SMB server:

Set-SmbServerConfiguration -RejectUnencryptedAccess 1

For DFS shares it is important, that referrals must be created with FQDN addresses.

2.3 AppConfig

It is mandatory for EBF Files to receive an AppConfig or a Managed-AppConfig from an UEM System (e.g. Ivanti EPMM, Microsoft Intune, Jamf). The AppConfig can/must (see table below) contain the following key/value pairs, where all values are of type “string”:

2.4 Encryption password policy

By default EBF Files does not force a policy for the encryption password. By using this parameter you can establish a policy.

Character classes that can be used are “upper case”, “lower case”, “numbers”, “special character”.

MaxLength: Maximum length of the password

MinLength: Minimum Length of the password

Complexity:
0 = no restriction
1 = 2 out of 4 character classes must be used
2 = 3 out of 4 character classes must be used
3 = 4 out of 4 character classes must be used

Example:
{
"MaxLength": 16, "MinLength": 3, "Complexity": 0
}

2.5 Container configuration

For parameter “serverlessConfig” a JSON string needs to be provided containing all the data needed to access the different data sources (containers).

Here is the list of all container types accepted by the client application while parsing the configuration:

OneDriveOnline, SharePointOnline, OneDriveOnPrem, SharePointOnPrem, MicrosoftSMBClient.

A description of the Json values can be seen in the table below:

Here is an example of a JSON configuration to be put into the AppConfig parameter “serverlessConfig”:
Files_Serverless_Config_Doku

2.6 AppTunnel/VPN

EBF Files uses server port 443 for communication with O365 and OneDrive/Sharepoint On-Premise data sources.

For SMB communication port 445 is used.

You may need to implement a VPN solution on the device to secure access to On-Premise data sources like OneDrive/Sharepoint On-Premise and SMB files servers.
It is recommended to use an UEM system’s VPN solution in that case.

2.7 Authentication and permissions

EBF Files currently allows user authentication via basic authentication and NTLM.
Kerberos SSO (Ivanti) can be used on iOS/iPadOS devices in combination with OneDrive/Sharepoint On-Premise servers.

For accessing documents from OneDrive/Sharepoint in O365 the Azure Application ID must be created with the following permissions all of type “Delegated”:

If a customer is using an ADFS for authentication to Azure he must make sure that “forms-based authentication” is activated for the authentication to succeed on the device. Otherwise he could see a message like “An error occurred. Contact your administrator for more information.“

2.8 Android specifics

The admin needs to make sure a browser app is installed in the device’s Work Profile to allow EBF Files to open a web view internally for the user to login to O365.

2.9 Container security class

For each container a security class can be defined. Different security classes are:

• Public (0)
• Internal (1)
• Confidential (2)
• Strict Confidential (3)

The security class has an effect when a user wants to copy/move a file or folder from one container to another.
These actions are possible only if the destination container has the same security level or higher.
Example of a user with two containers A and B:

• Container A has security class “Public” (0).
• Container B has security class “Confidential” (2).

The user can copy/move documents from container A to Container B, but he cannot copy/move documents from container B to container A. Only copy/move of documents inside of container B is allowed.

2.10 Azure Application ID

The Azure Application ID is a resource in Microsoft Azure needed to give EBF Files access to a customer’s OneDrive and SharePoint data sources. It is mandatory for the app registration to have set the Azure App Registration Settings to:

• Multitenant
• The iOS app redirect URL to public / native app with URL: „msauth.de.ebf.files://auth“
• The Android app redirect URL to public / native app with URL: “msauth://de.ebf.files/IF7piqtBrepbr0kQg79zjvHgTpE%3D”

Find more information on how to create an Azure Application ID here: Create Azure Application.