Registered Devices
Every device that installs the app registers itself, and that list is your view of where the app actually is.
Where to find it
Architect Panel → Mobile Apps:
- Mobile Canvas — the app, its screens and its settings
- App Builds & Releases — building and submitting
- Mobile Devices — the devices that have installed it
Architect Panel → Configuration:
- Site Settings — the Mobile Apps option group
What is recorded
The device identifier, the user, the platform, its push provider and token, whether push is enabled, the app version and build number, the operating system version, the device model and name, its locale and time zone, whether biometrics are enrolled, when it was first and last seen, its last manifest, and whether it has been revoked and why.
It answers the support questions
"Which version are they running", "when did they last use it", "is push enabled on that phone", "do they have biometrics set up". All of it is on one row, and all of it is the first thing you need when somebody reports a problem.
Start every mobile support conversation here rather than by asking the user.
Version spread is worth watching
A list of app versions in use tells you how quickly your users update, which decides whether you can rely on a new capability. If a quarter of devices are two versions behind, your minimum app version needs to reflect that.
Limit devices per user
An installation-level maximum, defaulting to five. Without it a user accumulates every phone they have ever installed on, each holding a session.
Idle devices expire automatically
Not seen for the configured period and the device expires. That keeps the list meaningful and closes the sessions on phones nobody has any more.
Six months is a reasonable default; shorter if the data is sensitive.
Revocation is the control that matters
A device can be revoked with a reason. That is what you do when a phone is lost, when somebody leaves, or when a device should not have the app.
Revoking records why, which matters afterwards — a device revoked with no reason is a question nobody can answer six months later.
Have a procedure and out-of-hours cover
Phones are lost at weekends. Know who can revoke a device outside working hours, and make sure they can actually reach the console.
Review the list periodically
Devices belonging to people who have left, devices last seen a year ago, users with more devices than they have hands. Each is a small risk and the list is short enough to read.
Worked example
An organisation limits users to three devices with idle expiry at six months, and its service desk starts every mobile query by looking at the device row. A quarterly review found four devices belonging to leavers whose accounts had been disabled but whose devices had not been revoked.
Recommendations
- Start support at the device row.
- Limit devices per user and expire idle ones.
- Always record a revocation reason.
- Include device revocation in your leaver process.