IT Considerations for the Windows App
Use this article if you manage firewalls, proxies, or antivirus for PCs that run the Mobile Locker Windows app. The current Windows app is a signed desktop app. It is not the older Electron build.
For Intune or another MDM, see Deploy the Windows app with Intune. If sign-in or sync fails with a certificate problem, see Amazon SSL certificate trust (Windows).
On this page
Get the app
Website download:
The Windows app installs per user to %LocalAppData%\MobileLocker\. The main program is %LocalAppData%\MobileLocker\current\MobileLocker.exe. It is Authenticode-signed as Vorenus Ventures LLC.
Allow these hosts
The app needs outbound HTTPS on port 443. Allow these hosts in your firewall, security system, VPN, or Zscaler.
Required for production
https://app.mobilelocker.com https://eu.mobilelocker.com https://mobilelocker.s3.amazonaws.com https://mobilelocker.s3.us-east-1.amazonaws.com https://mobilelocker-us-east-1.s3.amazonaws.com https://mobilelocker-eu-west-1.s3.amazonaws.com
app.mobilelocker.com is the US / global API. eu.mobilelocker.com is the EU API. The S3 hosts serve presentations and other files.
Also required unless you turn off public auto-update (see Deploy the Windows app with Intune):
https://mobilelocker.s3.amazonaws.com/windows/beta https://mobilelocker.s3.amazonaws.com/windows/stable
The same objects are also available on the regional host mobilelocker.s3.us-east-1.amazonaws.com.
Optional (support and staging builds only):
https://staging.mobilelocker.com
You do not need to allow teams.mobilelocker.com for the current Windows app.
App updates
On unmanaged PCs, the app can check the public S3 feed and update itself. On a managed fleet, set DisablePublicAutoUpdate=1 and redeploy a new Setup through your MDM. The content S3 hosts above are still required after you turn the feed off.
Windows Defender
If PCs use Windows Defender or a similar firewall, allow outbound HTTPS for MobileLocker.exe under %LocalAppData%\MobileLocker\current\.
Zscaler
If your company uses Zscaler, allow the required hosts above through it. SSL inspection can also block the app if Windows does not trust Amazon Root CA 1. See Amazon SSL certificate trust (Windows).
