Service Classes and Security Policies
Understanding Service Classes
Service classes are policy groups that define what security rules apply to enrolled browsers. They allow you to create different security profiles for different user groups.
Creating a Service Class
Step 1: Access Service Classes
- Navigate to Setup & Deployment > Service Classes
- Click Create New Service Class
Step 2: Configure Basic Settings
- Name: Descriptive name (e.g., "Finance Department")
- Description: Purpose and scope
- Priority Level: Determines which policies override others
Step 3: Assign Security Policies
Select the policies to include:
- Firewall ACLs: Domain blocking/allowing rules
- DLP Rules: Data loss prevention policies
- Browser Isolation: Sandboxing settings
- Content Filtering: Web category restrictions
Step 4: Set Advanced Options
- Auto-update interval: How often policies sync
- Bypass options: Emergency override settings
- Audit logging level: Detail level for events
Common Service Class Examples
Executive/VIP Class
- Minimal restrictions
- Enhanced monitoring
- Priority support
- Access to all business tools
Standard Employee Class
- Balanced security and productivity
- Block known malicious sites
- DLP for sensitive data
- Social media restrictions during work hours
Contractor/Guest Class
- Strict access controls
- Limited to approved sites only
- Enhanced DLP
- No file downloads
- Session time limits
IT/Security Team Class
- Administrative access
- Full visibility to all sites
- Testing and troubleshooting access
- Audit exemptions where needed
Assigning Service Classes
Service classes are assigned through:
- Enrollment Keys: Set default class for new enrollments
- Group Policies: Apply to user groups automatically
- Individual Assignment: Override for specific users
Best Practices
- Start with fewer, broader classes
- Test policies before full deployment
- Document each class's purpose
- Review and update quarterly
- Use descriptive naming conventions
Modifying Existing Classes
Changes to service classes:
- Take effect on next policy sync
- Can be force-pushed immediately
- Audit logs track all changes
- Previously enrolled devices update automatically