1.0 Introduction

The following document explains how to enroll mobile credentials for use with the Keri Confluence Mobile Key app. The mobile credentials are initially enrolled into the Confluence web portal. Once the credential has been enrolled, the user will received an SMS message together with instructions for downloading and installing the Android or iOS version of the Keri Confluence Mobile Key app.

 Mobile credentials offer an additional layer of security when compared with physical credentials as the phone itself needs to be unlocked before the mobile credential app can be used. Whereas, in comparison, if a physical credential is lost, anyone who finds that credential could potentially gain access to any door/lock which the credential has access rights to.

 The Confluence web portal is used to enroll and configure mobile credentials and their access rights. The access data is then immediately sent to the user's mobile app via the Allegion Engage Cloud service.

 The mobile credentials also function in a 'No Tour' mode. This means the lock data is written directly to the mobile credential (as opposed to someone having to physically visit the individual locks to update them). This allows mobile credential management to be performed from any single location that can access the Confluence web portal via the internet.

2.0 Enrolling a New Mobile Credential

Once locks have been added to the site and have been initially synced you will be able to enroll a new mobile credential using the Confluence web portal.

1. In the Confluence web portal, in the upper-left corner click Users then select Users.
   
   
   
   
2. The Users screen will appear.
3. Towards the upper-right of the screen, click the NEW USER button.
4. Enter the first name for the new user.
5. Enter the last name for the new user.
6. Enter the new user's e-mail address.
7. Enter the user's location (for example, where they live or where they work).
8. Select Expire Daily - the user will expire at 23:59:59 on the activation date.
9. Select Never Expire and the user will never expire.
10. If you leave Expire Daily and Never Expire unselected the user will activate on the Activation date and time and will expire at the Expiration date and time.
    
    
    
    
11. Click Submit.
12. Click the ADD MOBILE CREDENTIAL button.
    
    
    
13. Select the country for where the user is located.
14. Enter the phone number for the user.
15. Select the Credential function (typically most users will be set to the Normal function).
    
    
    
    - Normal - This mode unlocks the lock momentarily (with specified relock delay period).
    
    - Freeze - Freezes the lock in the current state. Lock remains frozen until Freeze credential is presented again. Disables all other credentials except for Pass Through.
    
    - One Time Use - Allows only one Normal access per assigned lock.
    
    - Pass Through - Unlocks a lock momentarily, regardless of state. Overrides a lock in Freeze and Lock Down states.
    
    - Lock Down - Changes the state of the lock to locked and disables all credentials except for Pass Through and Freeze. Present a Freeze to return lock to normal state.
    
    - Block - Denies access to the lock and records the access attempt as an audit.
    
    - Delete with Alarm - A delete with audit/alarm credential will log an audit entry that the credential was used. However, the credential will NOT unlock the door. If an alarm is available on the lock, then the alarm will sound. This functionality is the same as the “blocked” credential type.
    
    - Update from Server - Update from server credential will trigger the update from server in SF210 mode irrespective of lock state. In SF200 mode this credential will be treated as invalid credential.
    
    - Update From Server + Normal - Update from server+Normal credential will behave as normal credential and then trigger the update from server in SF210 mode irrespective of lock state. In SF200 mode this credential will be treated as normal credential only.
    
    
    
16. Leave the No Tour option enabled and access rights will then be automatically updated to the mobile credential. The Never Schedule should also be left at enabled.
    
    Important Notes:
    
    - If No Tour or the Never schedule are not enabled then it will not be possible to disable access for the mobile credential without physically visiting and updated using the Confluence by Keri app. The Never schedule is used when access to a lock is disabled for a user (see section 8.0).
    
    - Only the first enrolled mobile credential will have the Never schedule displayed.  All additional mobile credentials will only display the No Tour option.
    
    
    
    
17. Click the SUBMIT button and the mobile credential will be created.
18. The user will receive an SMS message on their smart phone with instructions for downloading and installing the Confluence Resident app.
    

3.0 Create a New Time Schedule

The Confluence web portal has two schedules defined by default (24/7) and Never. The following steps explain how to create an additional schedule (such as for a typical work week) and once selected for the user's access rights, access will only be granted during the times which are set in that time schedule.

Note: There are a maximum of 16 different time schedules that can be used with the

No Tour functionality for mobile credentials.

1. From the Confluence web portal go to Users >> Schedules.
   
   
   
2. Click the NEW SCHEDULE button on the right of the screen.
3. Enter a name for the schedule.
4. Select a time when access begins.
5. Select a time when access ends.
   
   
   
   
6. Select the days of the week when access will be granted.
   
   
   
   
7. Click the SUBMIT button to create the schedule.
   
   Note: Scheduled are assigned to locks when assigning access rights (see next two sections).

4.0 Assign the User Individual Access Rights

If your site has 11 or less locks, then the easiest method of assigning access is to use the Individual Access option.

1. On the user record screen, click on the ASSIGN ACCESS button.
   
   
   
   
2. Next to the lock model toggle the Access setting to enable access for the user.
   
   
   
   
3. By default the time schedule defaults to 24/7 access or you can select a different time schedule from the drop-down list.
4. Click the SAVE button and the individual access will be assigned to the user.

5.0 Create and Assign Access Groups

If your site has more than 11 locks, or if there are locks which are used by many different users, it is best to create access groups. Multiple locks can be added to access groups and any changes made to that group will be applied to all users which are assigned the group.

5.1 Create a New Access Group

The next steps explain how to create an access group (using the default 24/7 time schedule):

1. Go to Users >> Access Groups.
2. Click the NEW GROUP button.
3. Enter a name for the new access group.
4. The 24/7 schedule will already be selected.
5. Tap the SUBMIT button and the new access group will be created.
   
   
   
   
6. The locks can now be assigned to access groups and the access groups can then be assigned to users.

5.2 Assign Locks to an Access Group

Now that an access group has been setup and assigned a time schedule, you can assign locks to the group.

1. Go to Devices >> Devices.
2. Locate the lock/device to add to groups.
3. From the Manage drop-down, select Add to Access Group.
   
4. A window will appear with all access groups on the system, so select the group to assign.
5. Click BACK to return to the device list.
6. The assigned access group will then display in the lock record.

5.3 Assign Access Groups to Users

1. On the user list, click to reveal the 'Manage' drop-down list.
2. Select 'Add to Access Group'.
3. A window will appear allowing you to select the access group for the user.
4. Select an access group then click the SUBMIT button.
   
   
   
   
5. The access group will now be assigned to the user.

Note: After setting up a new access group any locks which are added to the group will need to be synced using the Confluence by Keri management app.

6.0 Download the Keri Confluence Mobile Key App

1. Go to the Google Play Store on your supported Android device or the APP Store on your iOS device.
2. Search for 'Keri Confluence Mobile Key'.
3. Click the INSTALL button.
   
   
   
   
4. The app will install within a few seconds.
   
   Note: Before opening the mobile key app ensure you have Bluetooth enabled on your phone.
   
   
5. Tap OPEN.
6. Select the country that you are located.
7. Tap the REQUEST OTP button.
8. A 5-digit logon code will be sent to you immediately via SMS.
9. Enter the code into the logon code field and tap the SUBMIT button.
10. The app will authenticate your initial login.
11. You will now see a notification that location permissions needs to be enabled for the app.
12. Go to the Keri Confluence Mobile Key app settings and enable Location permissions.
    
    
    
    
13. Return to the mobile key app and tap OK.
14. Swipe down on the screen and the app will sync with the Allegion server.
    
    Note: Whenever you log into the mobile key app the app will automatically sync with the Allegion server.
    
    
15. Any locks which you are assigned access to will be displayed.
    
    
    

7.0 Unlocking a Door With Your Mobile Credential

1. Go to within Bluetooth range of the lock. The approximately maximum distance is 20 feet/6m.
2. Tap and hold the TAP AND HOLD button.
3. The app will connect to the lock and within a few seconds the lock will unlock.
4. When the lock is unlocked the lock's LED will blink green and the lock will beep once.
5. The lock icon in the mobile key app will also go green.
   
   

8.0 Disabling Mobile Key Access

Note: Disabling mobile key access is done using the Confluence web portal. When a mobile key has had access disabled to a lock, the next time you open the app it will sync with the Cloud server and the app will then use the Never time schedule that exists on the lock(s).

1. Go to allegion.aetheros.net
2. Log into the web portal with your registered e-mail and password.
3. In the upper-left, click on Users >> Users.
   
   
   
   
4. Click the ASSIGN ACCESS button in the upper-right.
5. The device screen will appear.
6. Toggle the Access setting to remove access to the lock.
   
   
   
   
7. Save the device settings.
8. When the user next opens the app, the app will sync with the Allegion server and access will no longer be granted, at the lock which has access disabled. The look which has access disabled will not display on the locks screen.
   
   Note: When toggling access for a lock to OFF the schedule will automatically be set to Never. When toggling access back on again the schedule will go back to whatever active schedule the lock was previously set to.

P/N: 02478-001Rev.A