Category filter

Deploy Threema Work to iOS Devices with Hexnode UEM

TL;DR

Create a License for MDM System in the Threema Work Admin Console.
Add Threema Work. For Companies as an iOS Store App in Hexnode UEM.
Deploy the app through a Hexnode UEM policy or the Install Application remote action.
Upload the customized XML app configuration so the app receives the required Threema Work license and managed settings.

Threema Work is a GDPR-compliant instant messaging app for business communication. This guide explains how to deploy Threema Work. For Companies to managed iOS devices with Hexnode UEM, add the app to the Hexnode app inventory, apply a managed app configuration XML file, and associate the deployment with target devices or groups. The expected result is that the Threema Work app installs on selected iOS devices and receives the license, profile, backup, contact, communication, and chat restrictions defined in the XML configuration.

Use this workflow when your organization manages iOS devices through Hexnode UEM and uses a Threema Work license for an MDM system from the Threema Work Admin Console.

Requirements for Deploying Threema Work on iOS

Before deploying Threema Work with Hexnode UEM, make sure the following items are available:

Access to the Threema Work Admin Console.
A Threema Work License for MDM System with enough licenses for the iOS devices that will use the app.
Access to the Hexnode UEM console with permission to add apps, create or edit policies, associate policy targets, and run remote actions.
Managed iOS devices enrolled in Hexnode UEM.
A valid XML property list file that contains the Threema Work app configuration keys required by your organization.

How Threema Work Deployment Works in Hexnode UEM

Hexnode UEM deploys Threema Work to iOS as a managed app and applies app-specific settings through an XML app configuration. The XML file can include activation credentials, user profile values, contact behavior, backup controls, communication restrictions, and chat content settings supported by Threema Work for iOS.

The app can be deployed by associating a Hexnode UEM policy with devices, device groups, users, user groups, or Domains/OUs. For device-specific deployment, the Install Application remote action can also install the app after the app configuration has been uploaded in the app details.

Add a Threema Work License for the MDM System

If your organization uses managed iOS devices, create a Threema Work license for the MDM system before deploying the app through Hexnode UEM.

Log in to the Threema Work Admin Console.
Navigate to Enter Management Cockpit > User Management.
Click Add or Add First Users, and select License for MDM System.
Set a username and password as required.
Choose how the password should be stored:
1. Plain text: Allows password retrieval later. To retrieve the password, navigate to User Management > License for MDM Systems, locate the license, click its vertical ellipsis icon, and select Copy Password.
2. Hash: Provides additional security, but prevents password recovery from the Threema Work Admin Console.
Specify the number of licenses required for the devices that will use Threema Work.

The Threema Work Admin Console creates the license for the MDM system after these details are saved.

Add the Threema Work Store App to Hexnode UEM

Add the iOS Store App entry for Threema Work before configuring app deployment or managed app settings in Hexnode UEM.

Log in to the Hexnode UEM console.
Go to the Apps tab.
Click + Add Apps and select Store App from the dropdown menu.
In the dialog box, search for Threema Work. For Companies.
Click Add next to the app listed under iOS.

The Threema Work app is added to the managed app list in Hexnode UEM.

Deploy Threema Work Through a Hexnode UEM Policy

A Hexnode UEM policy can install Threema Work on selected iOS devices and apply the uploaded XML app configuration. Use this method when the app must be distributed to a defined set of policy targets.

Add Threema Work as a Required App

Go to the Policies tab.
Click Device Policies > New Policy > Create a fully custom policy to create a new policy, or select an existing policy to edit.
Enter the Policy Name and Description in the provided fields.
Navigate to iOS > App Management > Required Apps and click Configure.
Click +Add > Add App and search for Threema Work. For Companies.
Select the app and click Done.

Configure Threema Work Managed App Settings

Under App Configurations, click Configure.
Click +Add New Configuration, choose Threema Work. For Companies, and click Select. The Configure Application dialog box opens.
Click Choose File and upload the XML file customized with the required Threema Work app settings.
After the XML file is uploaded, click Done.
Click Save to apply the changes to the policy.

Sample XML Configuration

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>th_license_username</key>
    <string>eden_pierce</string>
    <key>th_license_password</key>
    <string>********</string>
    <key>th_nickname</key>
    <string>Eden</string>
    <key>th_linked_email</key>
    <string>edenpierce1990@gmail.com</string>
    <key>th_linked_phone</key>
    <string>+1-212-456-7890</string>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>th_license_username</key>

<string>eden_pierce</string>

<key>th_license_password</key>

<key>th_nickname</key>

<key>th_linked_email</key>

<string>edenpierce1990@gmail.com</string>

<key>th_linked_phone</key>

</dict>

</plist>

Supported Threema Work iOS App Configuration Settings

Threema Work for iOS supports several managed app configuration keys. Use these keys in the XML property list to align app behavior with your organization’s security, backup, communication, contact, and profile requirements.

Chat Content Settings

This table lists Threema Work iOS app configuration keys that control chat export, media saving, message previews, media sharing, and automatic deletion of old messages.

Threema Work chat content settings for iOS
Setting	Description
`th_disable_export`	If the value is set to `true`, the user cannot export chats.
`th_disable_save_to_gallery`	If the value is set to `true`, media files will not be auto-saved to the local gallery.
`th_disable_message_preview`	If the value is set to `true`, message previews in push notifications are disabled.
`th_disable_share_media`	If the value is set to `true`, saving and sharing media and other files outside Threema Work is prevented.
`th_keep_messages_days`	Specify a time span, from 1 week to 10 years in days, after which old chat messages are automatically deleted.

Communication Settings

This table lists Threema Work iOS app configuration keys that control group creation, Threema Web, multi-device linking, calls, group calls, video calls, and allowed web hosts.

Threema Work communication settings for iOS
Setting	Description
`th_disable_create_group`	If the value is set to `true`, the user cannot create groups.
`th_disable_web`	If the value is set to `true`, the desktop app, the web client (Threema Web), and the option to link devices are disabled.
`th_disable_multidevice`	If the value is set to `true`, the user cannot link other devices.
`th_disable_calls`	If the value is set to `true`, all Threema call types, including voice, video, and group calls, are disabled. Joining group calls is also not possible.
`th_disable_group_calls`	If the value is set to `true`, all group calls are disabled.
`th_disable_video_calls`	If the value is set to `true`, video functionality is disabled for one-to-one calls, but not for group calls.
`th_web_hosts`	Specify the servers that the desktop app and web client are allowed to connect to. Provide a comma-separated list of hostnames. To allow connections to all subdomains with a specific suffix, use an asterisk (``) as a wildcard prefix. Example: `signaling.threema.ch,-signaling-test.threema.ch` allows exact matches for `signaling.threema.ch` and any hostname ending with `-signaling-test.threema.ch`.

Contact Settings

This table lists Threema Work iOS app configuration keys that control address book synchronization, inactive IDs, unknown contacts, manual contact creation, and company directory access.

Threema Work contact settings for iOS
Setting	Description
`th_contact_sync`	If the value is set to `true`, synchronization with the local address book is enabled.
`th_hide_inactive_ids`	If the value is set to `true`, inactive IDs that have not been used for at least three months and revoked IDs are hidden.
`th_block_unknown`	If the value is set to `true`, unknown contacts that are not in the device’s contact list are blocked.
`th_disable_add_contact`	If the value is set to `true`, the user cannot manually add contacts. Contacts can only be added through contact sync, the company directory, or by receiving messages from unknown contacts.
`th_disable_work_directory`	If the value is set to `true`, access to the internal company directory is denied.

Backup Settings

This table lists Threema Work iOS app configuration keys that control Threema Safe, backup restrictions, ID export, restore behavior, custom safe servers, and backup passwords.

Threema Work backup settings for iOS
Setting	Description
`th_safe_enable`	If the value is set to `true`, Threema Safe must be used. If the value is set to `false`, Threema Safe cannot be used. If the value is not set, Threema Safe remains optional.
`th_disable_backups`	If the value is set to `true`, the user cannot create any kind of backup. This setting overrides `th_safe_enable`, `th_disable_data_backups`, `th_disable_system_backups`, and `th_disable_id_export`.
`th_disable_system_backups`	If the value is set to `true`, Threema data is excluded from iTunes/iCloud backups.
`th_disable_id_export`	If the value is set to `true`, the user cannot export their Threema ID.
`th_safe_restore_id`	Specify the Threema ID to restore from Threema Safe if `th_safe_restore_enable` is `true`. If `th_safe_password` is also set, the ID is restored without user interaction.
`th_safe_restore_enable`	If the value is set to `false`, Threema Safe backups cannot be restored. If the value is set to `true`, restoring a backup in the setup wizard is optional when `th_safe_restore_id` is not set, or mandatory when `th_safe_restore_id` is set.
`th_safe_password_message`	Set the error message shown if the password entered by the user for Threema Safe does not match the pattern defined in `th_safe_password_pattern`.
`th_safe_password_pattern`	Regular expression (Regex) that defines the allowed password format for Threema Safe. If not set, only a minimum length of 8 characters is enforced. The regex must be compatible with `NSRegularExpression`.
`th_safe_server_password`	Password for HTTPS authentication on the Threema Safe server defined in `th_safe_server_url`, if required.
`th_safe_server_url`	URL of the custom Threema Safe server, for example, `examplecompany.com/threemasafe`.
`th_safe_server_username`	Username for HTTPS authentication of the Threema Safe server defined in `th_safe_server_url`, if required.
`th_id_backup`	Provide precalculated key pairs (Threema IDs) and restore ID backups, which are called ID exports in newer versions.
`th_id_backup_password`	Set the password for the ID backup or export defined in `th_id_backup`.
`th_safe_password`	Set the password to encrypt Threema Safe backups, or to restore Threema Safe backups if `th_safe_restore_id` is set.

Profile Settings

This table lists Threema Work iOS app configuration keys that control app activation, user identity, profile fields, contact synchronization values, setup behavior, and profile editing restrictions.

Threema Work profile settings for iOS
Setting	Description
`th_license_username`	Set the username required to activate the app.
`th_license_password`	Set the password required to activate the app.
`th_lastname`	Specify the last name of the user.
`th_firstname`	Specify the first name of the user.
`th_category`	Specify the user category, such as group or department.
`th_department`	Specify the department of the user.
`th_job_title`	Specify the job title of the user.
`th_nickname`	Specify the nickname. The nickname appears in contact details and push notifications.
`th_linked_email`	Specify the email address linked to a Threema ID. It is used for contact synchronization.
`th_linked_phone`	Specify the phone number linked to a Threema ID. The number must be in international format, for example, `+41555114900`. It is used for contact synchronization.
`th_csi`	Specify the CSI (Customer Specific Identifier). This can be any value, such as an internal employee ID. It appears in the management cockpit and company directory and helps uniquely identify employees, especially when users have similar names.
`th_readonly_profile`	If the value is set to `true`, the user is prevented from editing their nickname, profile picture, linked email or phone, exporting or deleting their ID, and setting an ID revocation password.
`th_skip_wizard`	If the value is set to `true`, the setup wizard that appears on the first app launch is skipped.
`th_disable_send_profile_picture`	If the value is set to `true`, the user’s profile picture is not shared with others.

Associate the Threema Work Policy with iOS Devices

After the app and XML configuration are added to the policy, associate the policy with the iOS devices or user-based targets that should receive Threema Work.

Associate Targets Before Saving a New Policy

Navigate to Policy Targets > +Add Devices.
Choose the target devices and click OK.
Click Save.
You can also associate the policy with Device Groups, Users, User Groups, or Domains/OUs from the left pane of the Policy Targets tab.

Associate Targets After Saving a Policy

Go to the Policies tab under Device Policies and choose the required policy.
Click the Manage dropdown and select Associate Targets.
Choose the target entities and click Associate.

Deploy Threema Work with the Install Application Remote Action

The Install Application remote action can deploy Threema Work to a selected iOS device from the Manage tab. Update the app configuration in the app details before running the remote action.

Update the Threema Work App Configuration

Go to the Apps tab.
Search for Threema Work. For Companies and click the app to open the App Details dialog box.
Click the gear icon in the top-right corner and select App Configurations.
Choose Update App Configuration.
Click Choose File and upload the XML file with the customized app preferences.
Click Save.

Install Threema Work on an iOS Device

Go to the Manage tab.
Select the iOS device where Threema Work should be deployed.
Click Actions and choose Install Application.
Search for Threema Work. For Companies.
Select the app and click Install.

What Users See After Threema Work Deployment

After Hexnode UEM deploys the app and configuration, the iOS device receives the Threema Work. For Companies app and the managed settings defined in the XML file.

The Threema Work. For Companies app is automatically installed on the iOS device.
The user opens the app and taps Start Setup.
The user moves their fingers on the screen to generate a unique Threema ID for that user.
The user enters a new password for the profile and confirms it by re-entering the password.
The nickname, phone number, email address, and other settings are pre-filled based on the XML configuration.
The user completes setup by tapping Finish.

The Threema Work app is then deployed and configured on the targeted iOS devices.

Troubleshooting Threema Work Deployment in Hexnode UEM

Threema Work Installs but Managed Settings Are Not Applied

If Threema Work installs on the iOS device but the expected license, profile, or restriction settings are missing, verify that the customized XML file was uploaded under App Configurations. For policy-based deployment, confirm that the policy was saved after adding the XML configuration. For remote-action deployment, update the app configuration from the App Details dialog before running Install Application.

MDM License Password Cannot Be Retrieved from Threema Work

If the Threema Work license password was saved as a hash in the Threema Work Admin Console, it cannot be recovered from the console. Use plain text storage only when your organization requires later password retrieval through User Management > License for MDM Systems.

Threema Work Is Not Deployed to the Expected Targets

If targeted iOS devices do not receive the app through a policy, confirm that the policy is associated with the correct devices, device groups, users, user groups, or Domains/OUs. If the policy was already saved, use Manage > Associate Targets from the policy page to add the required targets.

Frequently Asked Questions

Does Hexnode UEM deploy Threema Work to iOS devices?

Yes. Hexnode UEM can add Threema Work. For Companies as an iOS Store App, deploy it as a required app through a policy, or install it on a selected iOS device using the Install Application remote action.

Does Threema Work deployment require a License for MDM System?

For managed devices, the source workflow requires a License for MDM System from the Threema Work Admin Console. The license username and password can then be included in the XML app configuration with the th_license_username and th_license_password keys.

Can Hexnode UEM configure Threema Work app settings on iOS?

Yes. Hexnode UEM applies Threema Work settings by uploading a customized XML property list under App Configurations. The XML can include supported Threema Work keys for chat contents, communication, contacts, backups, and profile settings.

How can Threema Work deployment be targeted in Hexnode UEM?

A Hexnode UEM policy can be associated with devices, device groups, users, user groups, or Domains/OUs. For a single iOS device deployment, use the Install Application remote action from the Manage tab.

Need more help?

Raise a Ticket

Ask Community

Chat With us