ISEC7 SPHERE
THE DIGITAL WORKPLACE MANAGEMENT PLATFORM

Frequently asked questions about ISEC7 SPHERE

How do I monitor several UEM platforms such as Microsoft Intune, Ivanti and BlackBerry UEM from one console?

Every UEM comes with its own console; for a combined view you need a layer on top that pulls device, user and policy data from each system's APIs. ISEC7 SPHERE is that layer and does not replace a UEM: it connects BlackBerry UEM on premises and in the cloud, Ivanti EPMM, Ivanti Sentry, Ivanti Neurons for MDM, Omnissa Workspace ONE UEM, Microsoft Intune and others at the same time. Every connection needs a service account in that system and a firewall rule. You get one status view and one reporting path across all platforms instead of one console per vendor.

What is digital workplace monitoring, and why do you need it?

Digital workplace monitoring watches the systems users' work depends on, such as UEM, mail, servers, network and applications, so IT sees deviations before users report them as outages. ISEC7 SPHERE brings data from UEM systems, servers, networks and applications into one database and uses error correlation and performance analytics to calculate a real-time health status. A certificate expiry, a CVE, a policy violation and a user ticket all refer to the same object there.

How do I migrate devices from one UEM vendor to another?

A phone can only be enrolled in one UEM environment at a time, so a vendor change means every device has to leave the old environment and enroll in the new one. ISEC7 SPHERE migrates users and devices from a source to a target environment using migration profiles, also between domains, between mail platforms and when devices are swapped. End users trigger the migration themselves, in the user self service portal or in the migration app for iPhone and Android, whose address and credentials your UEM distributes through app configuration. On Android, SMS, call history and local contacts can be carried over if the device runs in the COBO UEM mode; migrations across several domains need one service account per domain.

How do I find out whether a new CVE affects my servers?

A common approach is to match the software versions in use against the NIST National Vulnerability Database (NVD), which maps CVEs to specific products and versions through CPE identifiers. ISEC7 SPHERE does this for on-premises BlackBerry UEM, Ivanti, Microsoft Exchange and Microsoft SQL Server and for Omnissa Workspace ONE, and since version 20.8.0 for itself, including Apache Tomcat and Java. Every new CVE triggers an alert and stays open until someone acknowledges it; for endpoints, it monitors OS, patch and app levels from the connected UEM systems. Active vulnerability scanning and hardening checks are not part of it.

How do I keep track of expiring certificates, Apple DEP tokens and client secrets?

When a server certificate, an Apple DEP token or the client secret of an app registration in Microsoft 365 expires, connections, enrollment or data retrieval stop, so all three belong on the same expiry list. ISEC7 SPHERE monitors the certificates in use across connected systems in near real time, with scheduled or ad hoc reports on certificate parameters. It also tracks the expiry of Apple DEP tokens for the Microsoft 365 and Ivanti integrations and, since version 20.9.0, certificates and client secrets of any app registration in Microsoft 365.

How do I get UEM and mail system alerts into ServiceNow as tickets automatically?

The monitoring system itself has to open an incident when a status changes and close it once the status is back to normal; otherwise the handover stays manual. ISEC7 SPHERE does this in ServiceNow, and creates support cases in Salesforce the same way. Notifications also go out by email, SMS, SNMP, Microsoft Teams and BlackBerry AtHoc to recipient lists with their own filters, in English, German, French or Spanish. The delay before a notification can be set per status reason, and outgoing emails can be signed with S/MIME.

What is indigo, and how do I monitor compliance in an indigo environment?

indigo is the BSI framework for using iOS devices up to the German classification level VS-NfD; the approvals belong to the vendors of the products in use. Since version 20.9.0, ISEC7 SPHERE includes a dedicated dashboard for indigo compliance monitoring. It shows the status of the mandatory confirmation of indigo implementations with the related contacts, reports prohibited apps and lists the approved ecosystem apps with their installation counts, based on the BSI register entries. More on our indigo page.

Does ISEC7 SPHERE run on premises or in the cloud?

Both: ISEC7 SPHERE is available as an on-premises installation and as a cloud instance. Running it yourself requires Windows Server 2016, 2019, 2022 or 2025 (64-bit) and Microsoft SQL Server 2016, 2017, 2019 or 2022, and it can run in a virtual machine. Java and Apache Tomcat are included in the setup. For very large environments, the monitor and web components can be installed separately.

How is high availability handled in ISEC7 SPHERE?

As a cold standby: one instance is active, other instances wait on standby, connected to the same database, and are started manually if the active one fails. Switchover runs through a DNS alias or a load balancer, and agents re-resolve the alias at regular intervals. Each instance gets its own product key. The switchover belongs in the operations manual as a procedure, because it depends on DNS, agent resolution and the license check.

Last reviewed: 28 September 2026 · Feature information based on the ISEC7 SPHERE 20.8.0 administrator training and release 20.9.0