Home
Installation and Configuration
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
MCM and BigFix Mobile server and components installation
On-premises deployment setup
Understand the prerequisites and preparation required to install the BigFix MDM server and BigFix PlugIn Portal on-premise.
Prerequisites and requirements
The following packages must be pre-installed on your Red Hat® Enterprise Linux® systems before you install BigFix MCM and BigFix Mobile:

Installation and Configuration
Read this guide to learn about the requirements and available installation scenarios to ensure that the deployment of BigFix MCM and BigFix Mobile goes smoothly in your environment.
- MCM and BigFix Mobile server and components installation
  - Audience
    This guide is for administrators and IT managers who want to install and configure BigFix MCM and BigFix Mobile. It details prerequisites for each of the scenario and provides installation instructions that allow you to deploy the program in your environment. It also includes information about configuring and maintaining BigFix MCM and BigFix Mobile components.
  - Planning the installation
    Read this section before you begin to install or update any of the BigFix MCM or BigFix Mobile product features. Effective planning and an understanding of the key aspects of the installation process can help ensure a successful installation.
  - On-premises deployment setup
    Understand the prerequisites and preparation required to install the BigFix MDM server and BigFix PlugIn Portal on-premise.
    - Prerequisites and requirements
      The following packages must be pre-installed on your Red Hat® Enterprise Linux® systems before you install BigFix MCM and BigFix Mobile:
      - Minimum hardware requirements
        For minimum hardware requirements, see the BigFix Capacity Planning documentation.
      - TCP/IP Port requirements
        For BigFix MDM Server and BigFix PlugIn Portal to communicate properly with the devices that you manage, it is essential to configure the necessary TCP/IP ports. This section provides a comprehensive list of the required ports for managing your devices effectively.
    - BigFix PlugIn and MDM SSL certificates and keys
      SSL certificates and keys are required to authenticate the BigFix MDM PlugIns to the MDM Server.
    - Apple Push Notification certificates
      The Apple Push Notification Service (APNs) is used to notify Apple devices to check in with their assigned MDM Server. For your MDM Server to communicate with Apple device using the APNs, your MDM Server needs to be configured with an Apple push certificate and key. Obtaining an APNs certificate is only required if you plan to deploy the BigFix MCM Apple service or BigFix PlugIn.
    - WNS credentials
      BigFix Windows MDM service must be authenticated with Windows Notification Service (WNS) credentials. Once authenticated, the Windows MDM service receives a token that it can use to initiate communication with the Windows MDM devices.
    - Google Enterprise Credentials
      Google Enterprise Credentials are needed to utilize Android Management functionalities.
    - Installing BigFix PlugIn Portal
      The PlugIn Portal provides the server infrastructure for MCM and BigFix Mobile.
    - Installing MDM services
      You can set up MDM services for Windows, Apple, and/or Android through WebUI.
    - Installing MDM Plugin
      You need MDM Plugin to set up a connection between the MDM Servers and the BigFix Plugin Portal. MDM Plugin communicate with the MDM Server through REST APIs and the AMQP protocol using client certificates. For instructions on setting up through WebUI, see WebUI User’s Guide.
  - On-premises Upgrade
    If you already have BigFix MCM and/or BigFix Mobile 2.x deployment, and if you want to upgrade to version 3.x, you can find the instructions here.
  - Configuring BigFix MCM and BigFix Mobile
    After the MCM components are set up, there are additional configuration options available to enable features like Bulk Enrollment for Windows, DEP policies for macOS, or prestage installers for Windows and MacOS MDM endpoints.
  - Reference Information
    This section contains more detailed information about some of the essential installation aspects.
- Identity service configuration
  Starting from UEM3.0, MCM extends the capability to identify and manage devices based on users. The users can be identified based on their associated attributes including names, roles, group memberships, distribution list memberships, or physical locations. The devices identified based on users can then be targeted and managed through various configurations to provide conditional access and ensure compliance, endpoint security, and App protection.
- Simple Certificate Enrollment Protocol (SCEP) configuration
  BigFix MCM supports certificate management and certificate-based authentication through Simple Certificate Enrollment Protocol (SCEP). SCEP is the fastest and most secure way to provision certificates to all your MCM-managed devices. With SCEP, IT Admins can automate issuing certificates to the endpoints to provide access to corporate Wi-Fi, VPN, and secure e-mail through encryption.
- Domain join installation and configuration
  Read this section to learn the prerequisites and the tasks to install ODJ service to set up your environment to enroll Windows devices and join Active Directory domain or both Active Directory and Azure AD domain.
- SAML-authentication configuration
  MCM and BigFix Mobile supports Security Assertion Markup Language (SAML) authentication to enroll devices to protect sensitive data and ensure secure access to corporate resources.

Prerequisites and requirements

The following packages must be pre-installed on your Red Hat® Enterprise Linux® systems before you install BigFix MCM and BigFix Mobile:

BigFix MDM server

The target computers must have the following elements installed:
- The computer must be running on RHEL 7, RHEL 8, or RHEL 9
- Docker (CE v19.x or RHEL version 1.13 or later) and Docker Compose 1.25.x
  Note: RHEL8 distribution no longer provides Docker CE. To install a compatible Docker CE version on RHEL8 or RHEL9, refer to Installing Docker CE and Docker compose on RHEL8 or RHEL9.
- BigFix client version 10.0.10 or later (recommended version 10.0.10)
- OpenSSL
  Important: Up to MCM 2.1, port 5671 uses TLS 1.0 for internal communication. If the vulnerability scan detects exposure, you can ignore it. For more information, see Ignore MDM server vulnerability due to TLS 1.0.

To ensure proper execution of MCM startup scripts, Podman must be uninstalled, if it is installed in BigFix MDM server. This is because the presence of Podman can create conflicts with Docker, which is used as the container runtime for MCM service.
- DNF command to remove Podman
```
sudo dnf remove podman
```
- Yum command to remove Podman
```
sudo yum remove podman
sudo hash -r
```

The BigFix MDM server is typically deployed in the DMZ. Hence, appropriate security measures must be applied to the OS, firewall configuration, and system accounts.

BigFix PlugIn Portal

The target computers must have the following elements installed:

BigFix Client version 10.0.10 or later (recommended version 10.0.10)
BigFix PlugIn Portal version 10.0.10 or later (recommended version 10.0.10)