# Deploy Threema Work to iOS Devices with Hexnode UEM
Threema Work is a GDPR-compliant instant messaging app for business communication. This guide explains how to deploy **Threema Work. For Companies** to managed iOS devices with Hexnode UEM, add the app to the Hexnode app inventory, apply a managed app configuration XML file, and associate the deployment with target devices or groups. The expected result is that the Threema Work app installs on selected iOS devices and receives the license, profile, backup, contact, communication, and chat restrictions defined in the XML configuration.
Use this workflow when your organization manages iOS devices through Hexnode UEM and uses a Threema Work license for an MDM system from the Threema Work Admin Console.
Requirements for Deploying Threema Work on iOS
----------------------------------------------
Before deploying Threema Work with Hexnode UEM, make sure the following items are available:
- Access to the [Threema Work Admin Console](https://work.threema.ch/en/dashboard).
- A Threema Work **License for MDM System** with enough licenses for the iOS devices that will use the app.
- Access to the Hexnode UEM console with permission to add apps, create or edit policies, associate policy targets, and run remote actions.
- Managed iOS devices enrolled in Hexnode UEM.
- A valid XML property list file that contains the Threema Work app configuration keys required by your organization.
How Threema Work Deployment Works in Hexnode UEM
------------------------------------------------
Hexnode UEM deploys Threema Work to iOS as a managed app and applies app-specific settings through an XML app configuration. The XML file can include activation credentials, user profile values, contact behavior, backup controls, communication restrictions, and chat content settings supported by Threema Work for iOS.
The app can be deployed by associating a Hexnode UEM policy with devices, device groups, users, user groups, or Domains/OUs. For device-specific deployment, the **Install Application** remote action can also install the app after the app configuration has been uploaded in the app details.
Add a Threema Work License for the MDM System
---------------------------------------------
If your organization uses managed iOS devices, create a Threema Work license for the MDM system before deploying the app through Hexnode UEM.
1. Log in to the [Threema Work Admin Console](https://work.threema.ch/en/login?r=%2Fen%2Fdashboard).
2. Navigate to **Enter Management Cockpit > User Management**.
3. Click **Add** or **Add First Users**, and select **License for MDM System**.
4. Set a username and password as required.
5. Choose how the password should be stored:
1. **Plain text:** Allows password retrieval later. To retrieve the password, navigate to **User Management > License for MDM Systems**, locate the license, click its *vertical ellipsis* icon, and select **Copy Password**.
2. **Hash:** Provides additional security, but prevents password recovery from the Threema Work Admin Console.
6. Specify the number of licenses required for the devices that will use Threema Work.
The Threema Work Admin Console creates the license for the MDM system after these details are saved.
Add the Threema Work Store App to Hexnode UEM
---------------------------------------------
Add the iOS Store App entry for Threema Work before configuring app deployment or managed app settings in Hexnode UEM.
1. Log in to the Hexnode UEM console.
2. Go to the **Apps** tab.
3. Click **+ Add Apps** and select **Store App** from the dropdown menu.
4. In the dialog box, search for **Threema Work. For Companies**.
5. Click **Add** next to the app listed under iOS.
The Threema Work app is added to the managed app list in Hexnode UEM.
Deploy Threema Work Through a Hexnode UEM Policy
------------------------------------------------
A Hexnode UEM policy can install Threema Work on selected iOS devices and apply the uploaded XML app configuration. Use this method when the app must be distributed to a defined set of policy targets.
### Add Threema Work as a Required App
1. Go to the **Policies** tab.
2. Click **Device Policies > New Policy > Create a fully custom policy** to create a new policy, or select an existing policy to edit.
3. Enter the **Policy Name** and **Description** in the provided fields.
4. Navigate to **iOS > App Management > Required Apps** and click **Configure**.
5. Click **+Add > Add App** and search for **Threema Work. For Companies**.
6. Select the app and click **Done**.
### Configure Threema Work Managed App Settings
1. Under **App Configurations**, click **Configure**.
2. Click **+Add New Configuration**, choose **Threema Work. For Companies**, and click **Select**. The **Configure Application** dialog box opens.
3. Click **Choose File** and upload the XML file customized with the required Threema Work app settings.
4. After the XML file is uploaded, click **Done**.
5. Click **Save** to apply the changes to the policy.
### Sample XML Configuration
Sample XML configuration to customize the Threema Work application.
th\_license\_username eden\_pierce th\_license\_password \*\*\*\*\*\*\*\* th\_nickname Eden th\_linked\_email edenpierce1990@gmail.com th\_linked\_phone +1-212-456-7890
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
th\_license\_username
eden\_pierce
th\_license\_password
\*\*\*\*\*\*\*\*
th\_nickname
Eden
th\_linked\_email
edenpierce1990@gmail.com
th\_linked\_phone
+1-212-456-7890
Supported Threema Work iOS App Configuration Settings
-----------------------------------------------------
Threema Work for iOS supports several managed app configuration keys. Use these keys in the XML property list to align app behavior with your organization’s security, backup, communication, contact, and profile requirements.
### Chat Content Settings
This table lists Threema Work iOS app configuration keys that control chat export, media saving, message previews, media sharing, and automatic deletion of old messages.
Threema Work chat content settings for iOSSettingDescription`th_disable_export`If the value is set to `true`, the user cannot export chats.`th_disable_save_to_gallery`If the value is set to `true`, media files will not be auto-saved to the local gallery.`th_disable_message_preview`If the value is set to `true`, message previews in push notifications are disabled.`th_disable_share_media`If the value is set to `true`, saving and sharing media and other files outside Threema Work is prevented.`th_keep_messages_days`Specify a time span, from 1 week to 10 years in days, after which old chat messages are automatically deleted.### Communication Settings
This table lists Threema Work iOS app configuration keys that control group creation, Threema Web, multi-device linking, calls, group calls, video calls, and allowed web hosts.
Threema Work communication settings for iOSSettingDescription`th_disable_create_group`If the value is set to `true`, the user cannot create groups.`th_disable_web`If the value is set to `true`, the desktop app, the web client (Threema Web), and the option to link devices are disabled.`th_disable_multidevice`If the value is set to `true`, the user cannot link other devices.`th_disable_calls`If the value is set to `true`, all Threema call types, including voice, video, and group calls, are disabled. Joining group calls is also not possible.`th_disable_group_calls`If the value is set to `true`, all group calls are disabled.`th_disable_video_calls`If the value is set to `true`, video functionality is disabled for one-to-one calls, but not for group calls.`th_web_hosts`Specify the servers that the desktop app and web client are allowed to connect to. Provide a comma-separated list of hostnames. To allow connections to all subdomains with a specific suffix, use an asterisk (`*`) as a wildcard prefix. Example: `signaling.threema.ch,*-signaling-test.threema.ch` allows exact matches for `signaling.threema.ch` and any hostname ending with `-signaling-test.threema.ch`.### Contact Settings
This table lists Threema Work iOS app configuration keys that control address book synchronization, inactive IDs, unknown contacts, manual contact creation, and company directory access.
Threema Work contact settings for iOSSettingDescription`th_contact_sync`If the value is set to `true`, synchronization with the local address book is enabled.`th_hide_inactive_ids`If the value is set to `true`, inactive IDs that have not been used for at least three months and revoked IDs are hidden.`th_block_unknown`If the value is set to `true`, unknown contacts that are not in the device’s contact list are blocked.`th_disable_add_contact`If the value is set to `true`, the user cannot manually add contacts. Contacts can only be added through contact sync, the company directory, or by receiving messages from unknown contacts.`th_disable_work_directory`If the value is set to `true`, access to the internal company directory is denied.### Backup Settings
This table lists Threema Work iOS app configuration keys that control Threema Safe, backup restrictions, ID export, restore behavior, custom safe servers, and backup passwords.
Threema Work backup settings for iOSSettingDescription`th_safe_enable`If the value is set to `true`, Threema Safe must be used. If the value is set to `false`, Threema Safe cannot be used. If the value is not set, Threema Safe remains optional.`th_disable_backups`If the value is set to `true`, the user cannot create any kind of backup. This setting overrides `th_safe_enable`, `th_disable_data_backups`, `th_disable_system_backups`, and `th_disable_id_export`.`th_disable_system_backups`If the value is set to `true`, Threema data is excluded from iTunes/iCloud backups.`th_disable_id_export`If the value is set to `true`, the user cannot export their Threema ID.`th_safe_restore_id`Specify the Threema ID to restore from Threema Safe if `th_safe_restore_enable` is `true`. If `th_safe_password` is also set, the ID is restored without user interaction.`th_safe_restore_enable`If the value is set to `false`, Threema Safe backups cannot be restored. If the value is set to `true`, restoring a backup in the setup wizard is optional when `th_safe_restore_id` is not set, or mandatory when `th_safe_restore_id` is set.`th_safe_password_message`Set the error message shown if the password entered by the user for Threema Safe does not match the pattern defined in `th_safe_password_pattern`.`th_safe_password_pattern`Regular expression (Regex) that defines the allowed password format for Threema Safe. If not set, only a minimum length of 8 characters is enforced. The regex must be compatible with `NSRegularExpression`.`th_safe_server_password`Password for HTTPS authentication on the Threema Safe server defined in `th_safe_server_url`, if required.`th_safe_server_url`URL of the custom Threema Safe server, for example, `examplecompany.com/threemasafe`.`th_safe_server_username`Username for HTTPS authentication of the Threema Safe server defined in `th_safe_server_url`, if required.`th_id_backup`Provide precalculated key pairs (Threema IDs) and restore ID backups, which are called ID exports in newer versions.`th_id_backup_password`Set the password for the ID backup or export defined in `th_id_backup`.`th_safe_password`Set the password to encrypt Threema Safe backups, or to restore Threema Safe backups if `th_safe_restore_id` is set.### Profile Settings
This table lists Threema Work iOS app configuration keys that control app activation, user identity, profile fields, contact synchronization values, setup behavior, and profile editing restrictions.
Threema Work profile settings for iOSSettingDescription`th_license_username`Set the username required to activate the app.`th_license_password`Set the password required to activate the app.`th_lastname`Specify the last name of the user.`th_firstname`Specify the first name of the user.`th_category`Specify the user category, such as group or department.`th_department`Specify the department of the user.`th_job_title`Specify the job title of the user.`th_nickname`Specify the nickname. The nickname appears in contact details and push notifications.`th_linked_email`Specify the email address linked to a Threema ID. It is used for contact synchronization.`th_linked_phone`Specify the phone number linked to a Threema ID. The number must be in international format, for example, `+41555114900`. It is used for contact synchronization.`th_csi`Specify the CSI (Customer Specific Identifier). This can be any value, such as an internal employee ID. It appears in the management cockpit and company directory and helps uniquely identify employees, especially when users have similar names.`th_readonly_profile`If the value is set to `true`, the user is prevented from editing their nickname, profile picture, linked email or phone, exporting or deleting their ID, and setting an ID revocation password.`th_skip_wizard`If the value is set to `true`, the setup wizard that appears on the first app launch is skipped.`th_disable_send_profile_picture`If the value is set to `true`, the user’s profile picture is not shared with others.Associate the Threema Work Policy with iOS Devices
--------------------------------------------------
After the app and XML configuration are added to the policy, associate the policy with the iOS devices or user-based targets that should receive Threema Work.
### Associate Targets Before Saving a New Policy
1. Navigate to **Policy Targets > +Add Devices**.
2. Choose the target devices and click **OK**.
3. Click **Save**.
4. You can also associate the policy with **Device Groups**, **Users**, **User Groups**, or **Domains/OUs** from the left pane of the **Policy Targets** tab.
### Associate Targets After Saving a Policy
1. Go to the **Policies** tab under **Device Policies** and choose the required policy.
2. Click the **Manage** dropdown and select **Associate Targets**.
3. Choose the target entities and click **Associate**.
Deploy Threema Work with the Install Application Remote Action
--------------------------------------------------------------
The **Install Application** remote action can deploy Threema Work to a selected iOS device from the **Manage** tab. Update the app configuration in the app details before running the remote action.
### Update the Threema Work App Configuration
1. Go to the **Apps** tab.
2. Search for **Threema Work. For Companies** and click the app to open the **App Details** dialog box.
3. Click the *gear* icon in the top-right corner and select **App Configurations**.
4. Choose **Update App Configuration**.
5. Click **Choose File** and upload the XML file with the customized app preferences.
6. Click **Save**.
### Install Threema Work on an iOS Device
1. Go to the **Manage** tab.
2. Select the iOS device where Threema Work should be deployed.
3. Click **Actions** and choose **Install Application**.
4. Search for **Threema Work. For Companies**.
5. Select the app and click **Install**.
What Users See After Threema Work Deployment
--------------------------------------------
After Hexnode UEM deploys the app and configuration, the iOS device receives the **Threema Work. For Companies** app and the managed settings defined in the XML file.
1. The **Threema Work. For Companies** app is automatically installed on the iOS device.
2. The user opens the app and taps **Start Setup**.
3. The user moves their fingers on the screen to generate a unique Threema ID for that user.
4. The user enters a new password for the profile and confirms it by re-entering the password.
5. The nickname, phone number, email address, and other settings are pre-filled based on the XML configuration.
6. The user completes setup by tapping **Finish**.
The Threema Work app is then deployed and configured on the targeted iOS devices.
Troubleshooting Threema Work Deployment in Hexnode UEM
------------------------------------------------------
### Threema Work Installs but Managed Settings Are Not Applied
If Threema Work installs on the iOS device but the expected license, profile, or restriction settings are missing, verify that the customized XML file was uploaded under **App Configurations**. For policy-based deployment, confirm that the policy was saved after adding the XML configuration. For remote-action deployment, update the app configuration from the **App Details** dialog before running **Install Application**.
### MDM License Password Cannot Be Retrieved from Threema Work
If the Threema Work license password was saved as a hash in the Threema Work Admin Console, it cannot be recovered from the console. Use plain text storage only when your organization requires later password retrieval through **User Management > License for MDM Systems**.
### Threema Work Is Not Deployed to the Expected Targets
If targeted iOS devices do not receive the app through a policy, confirm that the policy is associated with the correct devices, device groups, users, user groups, or Domains/OUs. If the policy was already saved, use **Manage > Associate Targets** from the policy page to add the required targets.