Getting started with Geolocation Tracking policies

Geolocation refers to the identification of the most recent geographic location of a device. The Secure Endpoint Agent can collect the geolocation of a device and report that information in the Secure Endpoint Console.

The agent can collect geolocation information using any of the following technologies:

The technologies are presented in priority order. For example, if Wi-Fi is available, it takes precedence over all other technologies.

Each time a device uploads its location, it sends a payload containing data from all available geolocation technologies. Absolute then evaluates this data to determine if the device's location has changed and to ensure that the reported location is as accurate as possible.

In some cases, data may be ignored if a location's accuracy is low, or it is deemed to be invalid.

Example

A device's current Wi-Fi location is Los Angeles. Two hours later, it reports its Wi-Fi location is New York. Given that it's impossible to travel between these two cities in two hours, the new location is considered an anomaly and it is ignored. The device's primary location is not updated in the console.

To determine a device's primary location when more than one technology is available, the following priority order is applied:

1. Wi-Fi

   If a Wi-Fi location is available and valid, it takes precedence over all other technologies and it is reported as the device's primary location.

2. OS Location

   • Windows: If a Wi-Fi location is not available or valid, a valid OS location (if available) is reported as the device's primary location. Note that it is never reported as a secondary location.
   • Chromebook: If an OS location is available and valid, it is reported as the Chromebook device's primary location.

3. IP Location

   If no other technologies are available and valid, and the Geolocation setting is enabled in Account settings, the IP Location is reported as the device's primary location. Otherwise, it is reported as a secondary location.

A device's primary location is shown as Unknown when any of the following conditions apply:

• None of the reported locations are valid
• Location information is unavailable

If a valid location is less than 100 meters from its last reported location, the device's primary location is not updated, but its Last data received field is updated to the current date and time.

Regardless of the technology used to report a device's location change, the device's History page shows all available geolocation information, such as:

• BSSID and SSID of each detected Wi-Fi access point (applies to Wi-Fi locations on Window and Mac devices only)
• Detected public IP address
• Distances between secondary locations and the primary location

When a device changes its location by more than 100 meters, the following events are logged to Event History:

• Device location updated or Public IP location updated
• Device entered a geofence (if applicable)
• Device exited a geofence (if applicable)

Learn more about geolocation events

To collect geolocation information about your devices and make it available in the Secure Endpoint Console the following requirements must be met:

• Each device is running a supported version of the Windows, macOS, or Chrome OS operating system.
• The Secure Endpoint Agent is regularly connecting to the Absolute Monitoring Center.
• The device is not reported stolen.

In addition, the following requirements must be met for each platform:

Platform	Requirements
Windows	To detect a device's location, Location Services need to be enabled on the device in Settings > Privacy > Location. To detect locations using Wi-Fi, the device's Wi-Fi network adapter must be enabled. To detect locations using GPS, the device must be equipped with a built-in GPS chipset. External GPS cards are not supported. In the console, GPS locations show as OS Location.
Mac	To detect locations using Wi-Fi: The device's Wi-Fi network adapter must be enabled A device user that has allowed Absolute Secure Endpoint to collect location information is logged in to the device About user consent to collect Wi-Fi locations After the Geolocation Tracking policy is activated, each device user is presented with the following dialog: The dialog is displayed only once to each user. For Wi-Fi locations to be collected, all users need to click Allow in this dialog. If a user clicks Don't Allow, Wi-Fi locations will not be collected when that user is logged in. To identify devices with this issue, do the following: Go to the All Devices page and add the following filter: Wi-Fi error is Location permissions denied by current user. Review the filtered list of devices. For each Mac device included in the report, instruct the user to go to System Settings > Privacy & Security > Location Services and turn on Location Services for Absolute Secure Endpoint. For more information about turning on Location Services for an application, see Apple documentation. You may want to submit a Send Message request to send these instructions to each device. When no users are logged in to a Mac device, Wi-Fi locations are not available. In this case, the following Wi-Fi error is shown: No user logged in. GEO component not running.
Chromebook	The device must be equipped with sensors that are supported by Google's Geolocation API.

The Geolocation (GEO) component of the Secure Endpoint Agent is responsible for collecting geolocation information. When you activate a Geolocation Tracking policy, the GEO component is activated on each device after its next successful connection to the Absolute Monitoring Center.

How frequently is geolocation information collected?

Geolocation information is collected at different intervals depending on a device's platform type:

Platform	Details
Windows Mac	The Secure Endpoint Agent performs a daily scan of a device's current location and uploads the results to the Absolute Monitoring Center. Every two hours, it also performs a scheduled scan, but those results are uploaded only if the device's location has changed. Triggered scans In addition to the daily and scheduled scans, a scan is also triggered when any of the following events occur: The device is restarted. The detected public IP address, BSSID, or SSID changes. A user logs in to the device. Note that a scan is not triggered when a device is unlocked, or when it wakes from sleep mode or hibernation. If one or more of these events occur within a 15 minute period, only one scan result is uploaded. The results of a triggered scan are typically uploaded within the next 15 minutes, assuming the device is online. Triggered scans impact a device's scan schedule. For example, if a triggered scan occurs 20 minutes prior to the next scheduled scan, the scheduled scan is reset to start two hours after the triggered scan.
Chromebook	The Secure Endpoint Agent performs a daily scan of a device's current location and uploads the results to the Absolute Monitoring Center. It also performs an hourly scan, but those results are uploaded only if the device's public IP address or location has changed. Triggered scans In addition to the daily and hourly scheduled scans, a scan is also triggered when a user logs in to the device. However, if a user logs in more than once within a 15 minute period, only one scan result is uploaded. Note that a scan is not triggered when a device is unlocked, or when it wakes from sleep mode or hibernation. The results of a triggered scan are typically uploaded within the next 15 minutes, assuming the device is online. Triggered scans impact a device's hourly scan schedule. For example, if a triggered scan occurs 20 minutes prior to the next scheduled scan, the scheduled scan is reset to start 60 minutes after the triggered scan.

To see when a device's location was last scanned (and the results uploaded), add the Geolocation Tracking > Last data received column to the page or report.

If a device changes its location by less than 100 meters, the Last data received value is updated but no location change event is logged to the Events page.

By default, the Global Policy Group includes a Geolocation Tracking policy, which is set to Inactive. Although you can activate the policy in the Global Policy Group, best practice is to create custom policy groups and activate each policy group's Geolocation Tracking policy, as required.

After you activate a Geolocation Tracking policy, the GEO component begins collecting location information for the devices associated with the applicable policy group. Within the next 24 hours, you can view the location of your active devices by doing the following:

• Switch to map view in the Reports or Devices area
• Add geolocation-related columns to reports or Devices pages
• View the current location of a device in the summary area of its Device Details page
• View recent movement of a device on its History page or its Location History page

Note that the location of offline devices won't be available until they come online and check in to the Absolute Monitoring Center.

When a device moves from one location to another, one or more of the following events may be logged:

After you activate a Geolocation Tracking policy, use the Rules feature to help you monitor your devices' location changes and keep the devices secure. Rules allow you to be notified when a geolocation event occurs.