Manage mobile attendance

What this does

Organization administrators manage mobile attendance under Attendance. Mobile punches use the existing daily attendance record, not a second attendance system.

Before you start

Requires Org Admin access in an active organization and the Attendance plan entitlement. Employee/manager permissions alone do not grant access.

Steps

1. Open Attendance > Mobile Attendance. In Workplaces, create an office or edit an existing office location. Set name, address, city, country, IANA timezone, latitude (-90 to 90), longitude (-180 to 180), and radius (10-10000 metres). Office changes also appear in Organization Settings.
2. Register up to 20 canonical office egress CIDRs, one per line. These are not Wi-Fi names or BSSIDs. Do not register default routes or reverse-proxy/load-balancer networks. Network checks use the socket peer by default; only explicitly trusted ingress may supply the client address. Missing trusted evidence rejects safely. Egress, including an office VPN, is not proof of Wi-Fi presence. Deactivation requires confirmation and is blocked while employees remain assigned.
3. In Policy, explicitly save all five switches. WFH also requires employee WFH/hybrid mode; requiring an office network blocks WFH. Required location uses fresh, accurate evidence and includes accuracy in the office geofence. Home coordinates are not retained. Optional evidence is still validated. Biometric required requires fresh hardware-key enrollment, Android attestation trust configuration, a per-operation strong biometric signature, and server-verified Play Integrity. Missing configuration or proof blocks attendance. Disabling it is an explicit reduced-assurance policy change, not a biometric workaround. Emulator, rooted, and mock-location signals remain rejected. Device approval alone verifies neither hardware integrity nor biometrics.
4. In Devices, review the employee, device, Pending/Approved/Revoked status, registration and last successful use. Approve a pending device or confirm permanent revocation. Revoked keys cannot be reapproved; register a new device key. The list shows the newest 200 registrations.
5. In Events, filter accepted/rejected attempts by action, employee UUID, workplace and UTC date range. Review safe verification/rejection reasons and page through results. Times display in your local timezone. Older audit entries may lack context. Unknown reasons are shown generically; raw evidence, tokens, biometric material, IP addresses, and precise employee coordinates are not exposed.

Result

Accepted mobile transitions retain normal attendance, schedule, payroll-lock, and audit rules. Attendance Records identifies source=MOBILE; this describes record provenance, not a separate punch session. Rejected attempts never create successful attendance.

Related/Next guide: View attendance.