# Threema Work managed app settings for iOS
Threema Work is a secure, GDPR (General Data Protection Regulation)-compliant instant messaging solution designed for businesses to enable fast, efficient, and secure communication among employees. With robust end-to-end encryption, Threema Work ensures the safe exchange of confidential and sensitive information.
This guide provides step-by-step instructions on deploying the Threema Work app to iOS devices using Hexnode UEM, ensuring seamless and secure communication within your organization.
Steps to deploy Threema Work
-----------------------------
[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/02/Configuring-Threema-Work-app-settings-and-license-for-MDM-system.mov)
### Adding a License for the MDM System
If your company uses managed devices, you’ll need to add a license for the MDM system.
1. Log in to [Threema Work Admin Console](https://work.threema.ch/en/dashboard).
2. Navigate to **Enter Management Cockpit > User Management**.
3. Click **Add or Add First Users** and select **License for MDM System**.
4. Set a username and password as desired.
1. You can save the password in plain text or as a hash.
1. **Plain text**: Allows password retrieval later. To do this, navigate to **User Management > License for MDM Systems**, locate the specific license, click its *vertical ellipsis* icon, and select **Copy Password** from the dropdown.
2. **Hash**: Provides additional security but prevents password recovery from the Threema Work Admin Console.
5. Specify the number of licenses required for the devices that will use Threema Work.
This process will successfully create a license for your MDM system.
### Adding the Threema Work app to Hexnode UEM
1. Log in to the Hexnode UEM console.
2. Navigate to the **Apps** tab.
3. Click **+ Add Apps** and select **Store App** from the dropdown menu.
4. In the dialog box, search for “Threema Work. For Companies” and click **Add** next to the app listed under iOS.
This adds the Threema Work app to your list of managed apps in Hexnode UEM.
[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/02/Deploy-Threema-Work-app-settings-to-iOS-devices.mov)
### Deploying the app
1. Go to the **Policies** tab.
2. Click **Device Polices > New Policy > Create a fully custom policy** to create a new one or select an existing policy to edit.
3. Enter the **Policy Name** and **Description** in the provided fields.
4. Navigate to **iOS > App Management > Required Apps** and click **Configure**.
5. Click **+Add > Add App** and search for the “**Threema Work. For Companies**” app.
6. Select the app and click **Done**.
### Configuring app settings
1. Under **App Configurations**, click **Configure** to set up the Threema Work app.
2. Click **+Add New Configuration**, choose “**Threema Work. For Companies**” and click **Select**. This opens the **Configure Application** dialog box.
3. Click **Choose File** to upload the XML file customized with the app settings. Once uploaded, click **Done** and then **Save**.
**Sample XML configuration**
Sample XML configuration to customize the Threema Work application.
th\_license\_username eden\_pierce th\_license\_password \*\*\*\*\*\*\*\* th\_nickname Eden th\_linked\_email edenpierce1990@gmail.com th\_linked\_phone +1-212-456-7890
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
th\_license\_username
eden\_pierce
th\_license\_password
\*\*\*\*\*\*\*\*
th\_nickname
Eden
th\_linked\_email
edenpierce1990@gmail.com
th\_linked\_phone
+1-212-456-7890
6. Click **Save** to apply the changes.
### Threema Work App settings
You can customize how the Threema Work app behaves on iOS devices by setting various restrictions and preferences. These settings help align the app with your organization’s security and usage requirements.
Below is a categorized list of supported settings for iOS that you can configure.
**Chat contents**
Settings Descriptionth\_disable\_exportIf the value is set to true, the user cannot export chats.th\_disable\_save\_to\_galleryIf the value is set to true, media files will not be auto-saved to the local gallery.th\_disable\_message\_previewIf the value is set to true, the message preview in push notifications will be disabled.th\_disable\_share\_mediaIf the value is set to true, saving and sharing media and other files outside of Threema Work will be prevented.th\_keep\_messages\_daysSpecify a time span (1 week to 10 years in days) after which old chat messages will be automatically deleted.**Communication**
Settings Descriptionth\_disable\_create\_groupIf the value is set to true, the user cannot create groups.th\_disable\_webIf the value is set to true, the desktop app, the web client (Threema Web), and the option to link devices are disabled.th\_disable\_multideviceIf the value is set to true, the user will not be able to link other devices.th\_disable\_callsIf the value is set to true, all Threema call types (voice, video, and group) are disabled. Joining group calls is also not possible.th\_disable\_group\_callsIf the value is set to true, all group calls will be disabled.th\_disable\_video\_callsIf the value is set to true, video functionality is disabled for one-to-one calls but not for group calls.th\_web\_hostsSpecify the servers that the desktop app and web client are allowed to connect to. Provide a comma-separated list of hostnames. To allow connections to all subdomains with a specific suffix, use an asterisk (\*) as a wildcard prefix. Example: signaling.threema.ch,\*-signaling-test.threema.ch — this allows exact matches for signaling.threema.ch and any hostname ending with -signaling-test.threema.ch.
**Contacts**
Settings Descriptionth\_contact\_syncIf the value is set to true, synchronization with the local address book will be enabled.th\_hide\_inactive\_idsIf the value is set to true, inactive IDs (not used for at least three months) and revoked IDs are hidden.th\_block\_unknownIf the value is set to true, unknown contacts (not in the device’s contact list) will be blocked.th\_disable\_add\_contactIf the value is set to true, the user cannot manually add contacts. Contacts can only be added through contact sync, the company directory, or by receiving messages from unknown contacts.th\_disable\_work\_directoryIf the value is set to true, access to the internal company directory will be denied.**Backups**
Settings Descriptionth\_safe\_enableIf the value is set to true, Threema Safe must be used. If the value is set to false, Threema Safe cannot be used. If the value is not set, Threema Safe remains optional.th\_disable\_backupsIf the value is set to true, the user cannot create any kind of backup. This setting overrides th\_safe\_enable, th\_disable\_data\_backups, th\_disable\_system\_backups, and th\_disable\_id\_export.th\_disable\_system\_backupsIf the value is set to true, Threema data is excluded from iTunes/iCloud backups.th\_disable\_id\_exportIf the value is set to true, the user cannot export their Threema ID.th\_safe\_restore\_idSpecify the Threema ID to restore from Threema Safe if th\_safe\_restore\_enable is true. If th\_safe\_password is also set, the ID is restored without user interaction.th\_safe\_restore\_enableIf the value is set to false, Threema Safe backups cannot be restored. If the value is set to true, restoring a backup in the setup wizard is optional (if th\_safe\_restore\_id is not set) or mandatory (if th\_safe\_restore\_id is set).th\_safe\_password\_messageSet the error message shown if the password entered by the user for Threema Safe doesn’t match the pattern defined in th\_safe\_password\_pattern.th\_safe\_password\_patternRegular expression (Regex) that defines the allowed password format for Threema Safe. If not set, only a minimum length of 8 characters is enforced. Note that regex must be compatible with NSRegularExpression.th\_safe\_server\_passwordPassword for HTTPS authentication on the Threema Safe server defined in th\_safe\_server\_url, if required.th\_safe\_server\_urlURL of the custom Threema Safe server (e.g., examplecompany.com/threemasafe).th\_safe\_server\_usernameUsername for HTTPS authentication of the Threema Safe server defined in th\_safe\_server\_url, if required.th\_id\_backupProvide precalculated key pairs (Threema IDs) and restore ID backups (“ID exports” in newer versions).th\_id\_backup\_passwordSet the password for the ID backup/export defined in th\_id\_backup.th\_safe\_passwordSet the password to encrypt (or restore, if th\_safe\_restore\_id is set) Threema Safe backups.**Profile**
Settings Descriptionth\_license\_usernameSet the username required to activate the app.th\_license\_passwordSet the password required to activate the app.th\_lastnameSpecify the last name of the user.th\_firstnameSpecify the first name of the user.th\_categorySpecify the user category (e.g., group, department).th\_departmentSpecify the department of the user.th\_job\_titleSpecify the job title of the user.th\_nicknameSpecify the nickname. The nickname appears in contact details and push notifications.th\_linked\_emailSpecify the email address linked to a Threema ID. It is used for contact synchronization.th\_linked\_phoneSpecify the phone number linked to a Threema ID (must be in international format, e.g., +41555114900). It is used for contact synchronization.th\_csiSpecify the CSI (Customer Specific Identifier). This can be any value (e.g., an internal employee ID). It appears in the management cockpit and company directory and helps uniquely identify employees, especially in cases of similar names.th\_readonly\_profileIf the value is set to true, the user is prevented from editing their nickname, profile picture, linked email/phone, exporting/deleting their ID, and setting an ID revocation password.th\_skip\_wizardIf the value is set to true, the setup wizard that appears on the first app launch is skipped.th\_disable\_send\_profile\_pictureIf the value is set to true, the user’s profile picture will not be shared with others.### Associating the policy
If the policy has not been saved,
1. Navigate to **Policy Targets > +Add Devices**.
2. Choose the target devices and click **Ok**. Click **Save**.
3. You can also choose to associate the policy with **Device Groups, Users, User Groups, or Domains/OUs** from the left pane of the **Policy Targets** tab.
If the policy has been saved,
1. Go to the **Policies** tab under **Device Policies** and choose the desired policy.
2. Click on the **Manage** drop-down and select **Associate Targets**.
3. Choose the target entities and click **Associate**.
### Using Install Application remote action:
#### Updating App Configuration
1. Navigate to the **Apps** tab, search for “**Threema Work. For Companies**” and click on it to open the **App Details** dialog box.
2. Click the *gear* icon in the top-right corner and select **App Configurations**.
3. Choose **Update App Configuration**, then click **Choose File** to upload the XML file with your customized app preferences.
[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/02/Configuring-app-settings-for-Threema-Work-scaled.png)
5. Click **Save**.
#### Deploying the app to devices
1. Go to the **Manage** tab.
2. Select the iOS device to which you want to deploy the app.
3. Click **Actions** and choose **Install Application**.
[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/02/Deploying-Threema-Work-app-settings-using-Install-Application-action-scaled.png)
5. Search for “**Threema Work. For Companies**“, select the app, and click **Install**.
### What happens at the device end after deploying the Threema app configurations?
On the device:
1. The “**Threema Work. For Companies**” app will be automatically installed.
2. Open the app and tap **Start Setup**.
3. Move your fingers on the screen to generate a unique Threema ID, which will be exclusive to the user.
4. Enter a new password for the profile and confirm it by re-entering the password.
5. Your nickname, phone number, and email address will be pre-filled, along with other settings based on the configuration defined in the XML file.
6. Complete the setup by tapping **Finish**.
[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/02/Managing-configured-Threema-Work-app-settings.mov)
The Threema Work app will now be successfully deployed and configured on the iOS devices.