Guide to Deploying

VMware Workspace ONE

with VMware Identity
Manager
SEP 2018
VMware Workspace ONE
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

You can find the most up-to-date technical documentation on the VMware website at:
https://docs.vmware.com/
If you have comments about this documentation, submit your feedback to
[email protected]

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com

Copyright © 2017–2018 VMware, Inc. All rights reserved. Copyright and trademark information.

VMware, Inc. 2
 Contents

About Deploying VMware Workspace ONE 5

1 Introduction to Workspace ONE 6

Workspace ONE Architecture Overview 6
Requirements 7
Workspace ONE Feature Details 8
Getting Started with the Workspace ONE Wizard 9

2 Integrating Workspace ONE UEM With VMware Identity Manager 10

Set Up Integration from Workspace ONE UEM Console 10
Setting up an Workspace ONE UEM Instance in VMware Identity Manager 13
Enable Workspace ONE Catalog for Workspace ONE UEM 16
Enabling Compliance Checking for Workspace ONE UEM Managed Devices 17
Enable User Password Authentication through Workspace ONE UEM 17
Configure Compliance Checking Rules 18
Updating VMware Identity Manager After Upgrading Workspace ONE UEM 19
Implementing Authentication with AirWatch Cloud Connector 20

3 Implementing Mobile Single Sign-in Authentication for Workspace ONE UEM -

Managed iOS Devices 25
Implementation Overview to Configure Mobile SSO for iOS 25
Configure Active Directory Certificate Authority in Workspace ONE UEM 26
Using Workspace ONE UEM Certificate Authority for Kerberos Authentication 29
Using a Key Distribution Center for Authentication from iOS Devices 30
Configure Mobile SSO for iOS Authentication 31
Configure Built-in Identity Provider for Mobile SSO iOS Authentication 33
Configure Apple iOS Profile in Workspace ONE UEM Using Active Directory Certificate Authority
and Certificate Template 34
Configure Apple iOS Profile in Workspace ONE UEM Using Workspace ONE UEM Certificate
Authority 35
Assign a Workspace ONE UEM Device Profile 37

4 Implementing Mobile Single Sign-On Authentication for Managed Android

Devices 38
Supported Android Device 38

5 Direct Enrollment Using Workspace ONE App 39

Enable Workspace ONE for Direct Enrollment 39

VMware, Inc. 3
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

User Experience When Directly Enrolling into Workspace ONE UEM with Workspace ONE 42

6 Applying Workspace ONE to Support Apple Device Enrollment Program

Integration 50

7 Deploying the VMware Workspace ONE Mobile Application 52

Device Management Options in Workspace ONE UEM for Public and Internal Apps for
Workspace ONE 52
Managing Access to Applications 54
Requiring Terms of Use to Access the Workspace ONE Catalog 55
Getting and Distributing the Workspace ONE Application 56
Registering Email Domains for Auto Discovery 60
Session Authentication Setting 61
Deployment Strategies for Setting Up Multiple Workspace ONE UEM Organization Groups 62

8 Working in the Workspace ONE Portal 66

Working with Applications in Workspace ONE 66
Using the People Tab in Workspace ONE 70
Setting Passcodes for the Workspace ONE Application 71
Application-Level Passcodes on iOS Devices 72
Adding Native Applications 72
Using VMware Verify for User Authentication 72
Send Alerts to Workspace ONE Users 73
Working with Workspace ONE for Android Devices 73

9 Using the Workspace ONE Catalog 76

Managing Resources in the Catalog 76

10 Custom Branding for VMware Identity Manager Services 78

Customize Branding in VMware Identity Manager Service 78
Customize Branding for the User Portal 79

11 Accessing Other Documents 81

VMware, Inc. 4
About Deploying VMware Workspace
ONE

The Guide to Deploying VMware Workspace™ ONE™ with VMware Identity Manager provides
information about integrating VMware Identity Manager™ and VMware Workspace ONE UEM™ by
AirWatch to provide single sign-on to Workspace ONE, device management in Workspace ONE UEM,
and VMware Workspace ONE as a catalog of applications.

When Workspace ONE UEM and VMware Identity Manager are integrated, users with
Workspace ONE UEM enrolled devices can log in to their enabled applications securely without entering
multiple passwords.

Intended Audience
This information is intended for administrators who are familiar with both Workspace ONE UEM and
VMware Identity Manager services.

The September 2018 release applies to VMware Identity Manager Cloud September 2018, VMware
Identity Manager 3.3, and Workspace ONE UEM 9.7.

VMware, Inc. 5
Introduction to Workspace ONE 1
® ®
VMware Workspace ONE is a secure enterprise platform that delivers and manages applications on
iOS, Android, and Windows 10 devices. Identity, application, and enterprise mobility management are
integrated into the Workspace ONE platform.
®
VMware Workspace ONE UEM and VMware Identity Manager™ are integrated to give you the
Workspace ONE catalog of applications and mobile access management services.

VMware Identity Manager services provide the identity-related components, including authentication for
users who single sign-on to their resources. You create a set of policies that relate to networking and
authentication to control access to these resources.

Workspace ONE UEM services provide device enrollment, application distribution, and compliance
checking tools to ensure that remote access devices meet corporate security standards. Users from
Workspace ONE UEM enrolled devices can log in to their enabled applications securely without entering
multiple passwords.

This chapter includes the following topics:

n Workspace ONE Architecture Overview

n Requirements

n Workspace ONE Feature Details

n Getting Started with the Workspace ONE Wizard

Workspace ONE Architecture Overview

Workspace ONE provides users secure access to cloud, mobile, and Windows applications managed
from a unified catalog. For device access, the Workspace ONE native application is available for iOS,
Android, and Windows 10 devices.

When Workspace ONE is deployed, the following VMware Identity Manager and Workspace ONE UEM
services must be implemented.

n You can either configure the VMware Identity Manager Connector component or the AirWatch Cloud
Connector (ACC) component.

n Integration of your company's Active Directory with VMware Identity Manager or with
Workspace ONE UEM Cloud Connector to sync users and groups from Active Directory to the
Workspace ONE service.

VMware, Inc. 6
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n Configure VMware Identity Manager with Workspace ONE UEM API keys and the administrator root
certificate and enable the Workspace ONE catalog, compliance check, and user password
authentication through Workspace ONE UEM.

Figure 1‑1. Workspace ONE Architecture Overview

Users and Devices VMware Identity Manager

End-User Web/Virtual App SaaS-Based

Portal Catalog Apps

User Authentication Core Infrastructure

Directory Methods
VMware Identity
Workspace ONE App Access Horizon Manager Connector
Policies Integration or AirWatch Cloud
Connector

Horizon Apps

Horizon Desktops
VMware Workspace ONE UEM
Active Directory
Device Data Loss
Profiles Prevention

Email Corporate Directory

Integration Integration Public App
Stores
Content Mobile App
Integration Catalog

Requirements
The Workspace ONE system requirements are listed below.

Table 1‑1. Workspace ONE System Requirements

Workspace ONE Requirements Details

Active Directory Windows Server 2008 and 2008 R2

Windows Server 2012 and 2012 R2

Web browser to access VMware Identity Manager and Internet Explorer 11 for Windows
Workspace ONE consoles Google Chrome 4.0 and later
Mozilla Firefox 40 and later
Safari 6.2.8 and later

VMware Identity Manager Connector or AirWatch Cloud Windows Server 2008 R2

Connector installed. Windows Server 2012 or 2012 R2
.NET framework 4.6.2
For the VMware Identity Manager Connector installation guide
see the VMware Identity Manager Documentation Center. For
the AirWatch Cloud Connector installation guide, see the
Workspace ONE UEM Documentation Center.

VMware, Inc. 7
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Workspace ONE Feature Details

The major features in Workspace ONE are described below.

Native Mobile Workspace ONE Applications

Users can install the Workspace ONE application on a mobile device and use corporate credentials for
single sign-on (SSO) access to corporate, cloud, and mobile applications.

Self-service App Catalog for Web, Horizon, and Citrix Resources

Workspace ONE provides users access to cloud, mobile, and Windows applications using a unified
catalog. The catalog contains applications published to VMware Identity Manager and VMware
Workspace ONE UEM. Supported application types include internal web, SaaS, native mobile, internally
developed mobile, legacy and modern Windows, Horizon 7, VMware Horizon Cloud Service™, Citrix
published, and ThinApp packages. The application store also contains virtualized desktops.

Launch Web and Virtual Apps with Single Sign-on

Workspace ONE provides mobile single sign-on (SSO), a one-touch login implementation to mobile
applications. Mobile SSO is available for Android, iOS, and Windows 10 devices.

Conditional Access with Device Compliance

With Workspace ONE, you can enforce conditional access based on the network range, platform, and
application-specific criteria for authentication. A device must prove compliance with security rules before
authorizing access to an application. VMware Identity Manager includes an access policy option that can
be configured to check the Workspace ONE UEM server for device compliance status when users sign in
from the device.

Multi Factor Authentication

Workspace ONE provides multi factor authentication through the VMware Verify application. When a user
attempts to access the Workspace ONE catalog or any application requiring strong authentication,
VMware Verify sends a notification to the user’s phone. To verify attempted access to Workspace ONE,
the user must swipe Accept to access the application.

Adaptive Management
For applications that require only a basic level of security, users are not required to enroll their device into
Workspace ONE UEM Mobile Device Management™. Users can download the Workspace ONE mobile
application and select the applications they want to install. For applications that require a higher level of
security, users can enroll their device into Workspace ONE UEM directly from the Workspace ONE mobile
application.

VMware, Inc. 8
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Getting Started with the Workspace ONE Wizard

You can use the Workspace ONE Getting Started wizard to guide you through many of the configuration
steps to integrate Workspace ONE UEM and VMware Identity Manager services to create the Workspace
ONE environment.

The Getting Started wizard does not replace the ability to configure or edit any individual setting, but
significantly automates the initial setup for most customers.

The Workspace ONE Getting Started wizard can be used to set up the following.

n Enterprise Connector & Directory. The wizard walks you through the steps to set up the VMware
Enterprise System Connector and configure the Active Directory connection from the
Workspace ONE UEM Cloud Connector to import users and groups from your company's directory.
See the VMware Workspace ONE Quick Configuration Guide to help you set up the Enterprise
Connector.

n Auto Discovery. Run the wizard to register your email domain in the auto discovery service to make it
easier for end users to access their apps portal through the Workspace ONE application. End users
then enter their email address instead of the organization's URL.

n Workspace ONE Catalog. The Workspace ONE Catalog wizard walks you through the steps to set up
the Workspace ONE catalog. You can also use the Workspace ONE custom branding step to add you
company's brand information to the Workspace ONE catalog and application. See the VMware
Workspace ONE Quick Configuration Guide to help you set up the Workspace ONE Catalog.

n Adaptive Management. Set up adaptive management to restrict certain applications by requiring a

profile to be installed on the user's devices. The profile ensures that corporate applications and data
can be removed if required. You can also choose to require public applications to be managed or
used independently by manually downloading them from the app store.

The Getting Started wizard can alert you if existing potentially conflicting configurations are already
enable in Workspace ONE UEM or the VMware Identity Manager services. If this occurs, or the getting
started wizard only partially completes the steps, features can be configured manually. Use this guide to
configure the Workspace ONE UEM and VMware Identity Manager services manually for
Workspace ONE.

VMware, Inc. 9
Integrating
Workspace ONE UEM With
VMware Identity Manager 2
To set up Workspace ONE UEM mobile management services for devices with VMware Identity Manager
services for single sign-on and identity management for users, you must integrate the services.

When Workspace ONE UEM and VMware Identity Manager are integrated, users from
Workspace ONE UEM enrolled devices can log in to Workspace ONE to access their enabled
applications securely without entering multiple passwords.

The Workspace ONE Getting Started wizard can guide you through many of the configuration steps to
integrate Workspace ONE UEM and VMware Identity Manager. See the VMware Workspace ONE Quick
Configuration Guide to run the Workspace ONE wizards.

This chapter includes the following topics:

n Set Up Integration from Workspace ONE UEM Console

n Setting up an Workspace ONE UEM Instance in VMware Identity Manager

n Enable Workspace ONE Catalog for Workspace ONE UEM

n Enabling Compliance Checking for Workspace ONE UEM Managed Devices

n Enable User Password Authentication through Workspace ONE UEM

n Configure Compliance Checking Rules

n Updating VMware Identity Manager After Upgrading Workspace ONE UEM

n Implementing Authentication with AirWatch Cloud Connector

Set Up Integration from Workspace ONE UEM Console

To integrate with VMware Identity Manager services, configure these settings in the
Workspace ONE UEM console.

n Rest API admin key for communication with the VMware Identity Manager service

n REST enrolled user API key for AirWatch Cloud Connector password authentication created in the
same organization group where VMware Identity Manager is configured.

n API Admin account for VMware Identity Manager and the admin auth certificate that is exported from
Workspace ONE UEM and added to the AirWatch settings in the VMware Identity Manager console.

VMware, Inc. 10
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Create REST API Keys in Workspace ONE UEM

REST Admin API access and enrolled users access must be enabled in the Workspace ONE UEM
console to integrate VMware Identity Manager with Workspace ONE UEM. When you enable API access,
an API key is generated.

Procedure

1 In the Workspace ONE UEM console, select the Global > Customer-level organization group and
navigate to Groups & Settings > All Settings > System > Advanced > API > Rest API.

2 In the General tab, click Add to generate the API key to use in the VMware Identity Manager service.
The account type should be Admin.

Provide a unique service name. Add a description, such as AirWatchAPI for IDM.

3 To generate the enrollment user API key, click Add again.

4 In the Account Type drop-down menu, select Enrollment User.

Provide a unique service name. Add a description such as UserAPI for IDM.

5 Copy the two API keys and save the keys to a file.

You add these keys when you set up Workspace ONE UEM (AirWatch) in the
VMware Identity Manager console.

6 Click Save.

Export VMware Workspace ONE UEM Administrator Root

Certificate
After the admin API key is created, you add an admin account and set up certificate authentication in the
Workspace ONE UEM console.

VMware, Inc. 11
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

For REST API certificate-based authentication, a user level certificate is generated from the
Workspace ONE UEM console. The certificate used is a self-signed Workspace ONE UEM certificate
generated from the Workspace ONE UEM admin root cert.

Prerequisites

The Workspace ONE UEM REST admin API key is created.

Procedure

1 In the Workspace ONE UEM console, select the Global > Customer-level organization group and
navigate to Accounts > Administrators > List View.

2 Click Add > Add Admin.

3 In the Basic tab, enter the certificate admin user name and password in the required text boxes.

4 Select the Roles tab and choose the current organization group and click the second text box and
select AirWatch Administrator.

5 Select the API tab and in the Authentication text box, select Certificates.

6 Enter the certificate password. The password is the same password entered for the admin on the
Basic tab.

7 Click Save.

The new admin account and the client certificate are created.

VMware, Inc. 12
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

8 In the List View page, select the admin you created and open the API tab again.

The certificates page displays information about the certificate.

9 Enter the password you set in the Certificate Password text box, click Export Client Certificate and
save the file.

The client certificate is saved as a .p12 file type.

What to do next

Configure your Workspace ONE UEM URL settings in the VMware Identity Manager console.

Setting up an Workspace ONE UEM Instance in

VMware Identity Manager
After you configure the settings in the Workspace ONE UEM console, in the VMware Identity Manager
console Identity & Access Management page, you enter the Workspace ONE UEM URL; the API key
values, and the certificate. After Workspace ONE UEM settings are configured, you can enable feature
options available for Workspace ONE.

Add Workspace ONE UEM Settings to VMware Identity Manager

Configure Workspace ONE UEM settings in VMware Identity Manager to integrate Workspace ONE UEM
with VMware Identity Manager and enable the Workspace ONE UEM feature integration options. The
Workspace ONE UEM API key and the certificate are added for VMware Identity Manager authorization
with Workspace ONE UEM.

Prerequisites

n Workspace ONE UEM server URL that the admin uses to log in to the Workspace ONE UEM
console.

n Workspace ONE UEM admin API key that is used to make API requests from
VMware Identity Manager to the Workspace ONE UEM server to set up integration.

VMware, Inc. 13
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n Workspace ONE UEM certificate file used to make API calls and the certificate password. The
certificate file must be in the .p12 file format.

n Workspace ONE UEM enrolled user API key.

n Workspace ONE UEM group ID for your tenant, which is the tenant identifier in
Workspace ONE UEM.

Procedure

1 In the VMware Identity Manager console, Identity & Access Management tab, click Setup >
AirWatch.

2 Enter the Workspace ONE UEM integration settings in the following fields.

Field Description
AirWatch API URL Enter the Workspace ONE UEM URL. For example, https://myco.ws1uem.com

AirWatch API Certificate Upload the certificate file used to make API calls.

Certificate Password Enter the certificate password.

AirWatch Admin API Key Enter the admin API key value. Example of an API key value
FPseqCSataGcnJf8/Rvahzn/4jwkZENGkZzyc+jveeYs=

AirWatch Enrolled User API Key Enter the enrolled user API key value.

AirWatch Group ID. Enter the Workspace ONE UEM group ID for the organization group that the API
key and admin account were created in.

VMware, Inc. 14
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

3 Click Save.

What to do next

Enable the feature option Workspace ONE Catalog to merge apps set up with the Workspace ONE UEM
catalog to the Workspace ONE catalog.

n Enable Compliance check to verify that Workspace ONE UEM managed devices adhere to
Workspace ONE UEM compliance policies.

See Enabling Compliance Checking for Workspace ONE UEM Managed Devices.

Mapping VMware Identity Manager Domains to Multiple

Organization Groups in Workspace ONE UEM
When setting up users and devices in Workspace ONE UEM, Workspace ONE UEM uses organization
groups (OG) to organize and group users and to establish permissions. When Workspace ONE UEM is
integrated with VMware Identity Manager, the admin and enrollment user REST API keys can only be
configured at the Workspace ONE UEM organization group of type Customer.

In Workspace ONE UEM environments configured for multi-tenancy, many organization groups are
created for users and devices. Devices become registered or enrolled into an organization group.
Organization groups can be set up in unique configurations in a multi-tenancy environment. For example,
organization groups by separate geographies, departments, or use cases.

VMware, Inc. 15
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

You can link domains configured in VMware Identity Manager to specific organization groups in
Workspace ONE UEM to manage device registration through Workspace ONE. When users log in to
Workspace ONE, a device registration event is triggered within VMware Identity Manager. During the
device registration, a request is sent to Workspace ONE UEM to pull any applications that the user and
device combination is entitled to.

The device organization groups must be identified when Workspace ONE UEM is integrated with
VMware Identity Manager so that identity manager can locate the user and successfully register the
device into the appropriate organization group.

When you configure the Workspace ONE UEM settings in the VMware Identity Manager service, you can
enter device organization group IDs and the API keys to map multiple OG to a domain. When users sign
in to Workspace ONE from their devices, the user records are verified and the device is registered to the
appropriate organization group in Workspace ONE UEM.

To learn more about how to configure multiple organization groups, see Deployment Strategies for Setting
Up Multiple Workspace ONE UEM Organization Groups.

Note When Workspace ONE UEM is integrated with VMware Identity Manager and multiple
Workspace ONE UEM organization groups are configured, the Active Directory Global Catalog option
cannot be configured for use with the VMware Identity Manager service.

Enable Workspace ONE Catalog for Workspace ONE UEM

When you configure VMware Identity Manager with your Workspace ONE UEM instance, you can enable
the Workspace ONE catalog to include the apps from the Workspace ONE UEM Catalog. End users see
all applications that they are entitled to from their Workspace ONE portal.

Procedure

1 In the VMware Identity Manager console, Identity & Access Management tab, click Setup > AirWatch
and navigate to the Workspace ONE Catalog section.

2 To include apps from the AirWatch Catalog with apps in the identity manager catalog, enable both
Fetch from IDM and Fetch from Airwatch.

When using Workspace ONE catalog on mobile devices without the VMware Identity Manager
service configured, select only Fetch from AirWatch.

The default is Fetch from IDM enabled.

3 Click Save.

What to do next

Notify Workspace ONE UEM end users about how to access the catalog and view their Workspace ONE
portal.

VMware, Inc. 16
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Enabling Compliance Checking for Workspace ONE UEM

Managed Devices
When users enroll their devices, samples containing data used to evaluate compliance are sent on a
scheduled basis. The evaluation of this sample data ensures that the device meets the compliance rules
set by the administrator in the Workspace ONE UEM (UEM) console. If the device goes out of
compliance, corresponding actions configured in the UEM console are taken.

The VMware Identity Manager service includes an access policy option that can be configured to check
the Workspace ONE UEM server for device compliance status when users sign in from the device. The
compliance check ensures that users are blocked from signing in to an application or using single sign-in
to the Workspace ONE portal if the device goes out-of-compliance. When the device is compliant again,
the ability to sign in is restored.

The Workspace ONE application automatically signs out and blocks access to the applications if the
device is compromised. If the device was enrolled through adaptive management, an enterprise wipe
command issued through the UEM console unenrolls the device and removes the managed applications
from the device. Unmanaged applications are not removed.

For more information about Workspace ONE UEM compliance policies, see the VMware Workspace ONE
UEM Mobile Device Management Guide, in the VMware Workspace ONE UEM Documentation pages.

Enable User Password Authentication through

Workspace ONE UEM
To implement authentication with the AirWatch Cloud Connector, you must enable the Password
Authentication through Workspace ONE UEM feature.

Prerequisites

n Workspace ONE UEM configured in VMware Identity Manager.

n AirWatch Cloud Connector installed and activated.

n Workspace ONE UEM directory services integrated with Active Directory.

Procedure

1 In the VMware Identity Manager console, Identity & Access Management tab, click Setup > AirWatch

2 In the User Password Authentication through AirWatch section, select Enable.

3 Click Save.

What to do next

See Implementing Authentication with AirWatch Cloud Connector to use AirWatch Cloud Connector
authentication.

VMware, Inc. 17
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Configure Compliance Checking Rules

When Compliance Check is enabled, you create an access policy rule that requires authentication and
device compliance verification for devices managed by Workspace ONE UEM.

The compliance checking policy rule works in an authentication chain with Mobile SSO for iOS, Mobile
SSO for Android, and Certificate cloud deployment. When configuring the rule, the authentication method
to use must precede the device compliance method.

Prerequisites

Authentication methods configured and associated to a built-in identity provider.

Compliance checking enabled in the VMware Identity Manager AirWatch page.

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, select Manage >
Policies.

2 Click Edit Default Policy.

3 Click Next.

4 Click Add Policy Rule to add a rule, or select a rule to edit.

Option Description

If a user's network range is Verify that the network range is correct, If adding a rule, select the network range.

and user accessing content from Select the mobile device type.

and user belongs to groups If this access rule is going to apply to specific groups, search for the groups in the
search box.
If no group is selected, the access policy applies to all users.

Then perform this action Select Authenticate using....

then the user may authenticate using Select the mobile device authentication method to apply.
Click + and in the drop-down menu select Device Compliance (with AirWatch).

If the preceding methods fails or is not Configure the fallback authentication method, if necessary.
applicable, then

Re-authenticate after Select the length of the session, after which users must authenticate again.

VMware, Inc. 18
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

5 Click Save.

Updating VMware Identity Manager After Upgrading

Workspace ONE UEM
When you upgrade Workspace ONE UEM to a new version, you must update the Workspace ONE
Catalog and User Password Authentication options on the AirWatch configuration page in the
VMware Identity Manager console.

When you save these options after you upgrade Workspace ONE UEM, the AirWatch settings in the
VMware Identity Manager service are updated with the new version of Workspace ONE UEM.

Procedure

1 After you upgrade Workspace ONE UEM, sign in to the VMware Identity Manager console.

2 In the Identity & Access Management tab, click Setup > AirWatch.

3 Scroll down the page to the Workspace ONE Catalog section and click Save.

4 Scroll down to the User Password Authentication through AirWatch section and click Save.

The Workspace ONE UEM configuration is updated with the new version in the VMware Identity Manager
service.

VMware, Inc. 19
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Implementing Authentication with AirWatch Cloud

Connector
The AirWatch Cloud Connector (ACC) component of VMware Enterprise Systems Connector is integrated
with VMware Identity Manager for user password authentication in Workspace ONE.

Note You install ACC and configure the ACC component in Workspace ONE UEM. See the VMware
Enterprise Systems Connector Installation and Configuration guide for information about installing and
configuring the AirWatch Cloud Connector. After the ACC is installed and configured, you integrate the
Workspace ONE UEM directory services with Active Directory. See the VMware Workspace ONE UEM
Directory Services Guide for information about enabling the directory services.

To implement AirWatch Cloud Connector authentication for Workspace ONE, in the

VMware Identity Manager console, the Password (Workspace ONE UEM Connector) authentication
method is associated to a built-in identity provider.

You can enable just-in-time support in Workspace ONE UEM to add new users to the
VMware Identity Manager directory when users sign in for the first time. When just-in-time support is
enabled, users do not need to wait for the next scheduled sync from the Workspace ONE UEM server to
access Workspace ONE. Instead, new users sign in to their Workspace ONE portal, either from an iOS or
Android device or from their desktop computer and enter their Active Directory user name and password.
The VMware Identity Manager service authenticates the Active Directory credentials through the AirWatch
Cloud Connector and adds the user profile to the directory.

After you associate the authentication methods in the built-in identity provider, you create access policies
to apply to this authentication method.

Note User name and password authentication are integrated into the AirWatch Cloud Connector
deployment. To authenticate users using other VMware Identity Manager -supported authentication
methods, the VMware Identity Manager connector must be configured.

Managing User Attributes Mapping

You can configure the user attribute mapping between the Workspace ONE UEM directory and the
VMware Identity Manager directory.

The User Attributes page in the VMware Identity Manager, Identity & Access Management tab lists the
default directory attributes that are mapped to Workspace ONE UEM Directory attributes. Attributes that
are required are marked with an asterisk. Users missing a required attribute in their profile are not synced
to the VMware Identity Manager service.

Table 2‑1. Default Workspace ONE UEM Directory Attributes Mapping

VMware Identity Manager User Attribute Name Default Mapping to Workspace ONE UEM User Attribute

userPrincipalName userPrincipalName

distinguishedName distinguishedName

VMware, Inc. 20
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Table 2‑1. Default Workspace ONE UEM Directory Attributes Mapping (Continued)
VMware Identity Manager User Attribute Name Default Mapping to Workspace ONE UEM User Attribute

employeeID employeeID

domain Domain

disabled (external user disabled) disabled

phone telephoneNumber

lastName lastname*

firstName firstname*

email Email*

userName username*

Sync Users and Groups from Workspace ONE UEM Directory to

VMware Identity Manager Directory
You configure the VMware Identity Manager settings in the Workspace ONE UEM console to establish a
connection between your organization group instance of the Workspace ONE UEM Directory and
VMware Identity Manager. This connection is used to sync users and groups to a directory created in the
VMware Identity Manager service.

Users and groups initially sync to the VMware Identity Manager directory manually. The
Workspace ONE UEM sync schedule determines when users and groups sync with the
VMware Identity Manager directory.

When a user or a group is added or deleted on the Workspace ONE UEM server, the change is reflected
on the VMware Identity Manager service immediately.

Prerequisites

n VMware Identity Manager local admin name and password.

n Identify attribute values to map from the Workspace ONE UEM directory. See Managing User
Attributes Mapping.

Procedure

1 In the Workspace ONE UEM console, Groups & Settings, All Settings page, select the Global >
Customer-level organization group and navigate to System > Enterprise Integration >VMware
Identity Manager.

2 In the Server section, click Configure.

Note The configuration button is only available when the Directory Service is also configured for the
same organization group. If the Configure button is not visible, you are not in the correct organization
group. You can change the organization group in the Global drop-down menu.

VMware, Inc. 21
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

3 Enter the VMware Identity Manager settings.

Option Description

URL Enter your tenant VMware URL. For example,

https://myco.identitymanager.com.

Admin Username Enter the VMware Identity Manager local admin user name.

Admin Password Enter theVMware Identity Manager local admin user's password.

4 Click Next.

5 Enable custom mapping to configure the user attributes mapping from Workspace ONE UEM to the
VMware Identity Managerservice.

6 Click Test Connection to verify that the settings are correct.

7 Click Sync Now to manually sync all users and groups to VMware Identity Manager service.

Note To control the system load, manual sync can only be performed four hours after a previous
sync.

An Workspace ONE UEM directory is created in the VMware Identity Manager service and the users and
groups are synced to a directory in VMware Identity Manager.

What to do next

Review the Users and Groups tab in the VMware Identity Manager console to verify that the user and
group names are synced.

Managing Configuration of Password Authentication to

Workspace ONE UEM
You can review and manage the Password (AirWatch Connector) configuration that was set up when you
installed Workspace ONE UEM and added the VMware Identity Manager service.

The Password (AirWatch Connector) authentication method is managed from the Identity & Access
Management > Authentication Methods page and is associated to the built-in identity provider in the
Identity Providers page.

Important When the AirWatch Cloud Connector software is upgraded, make sure that you update the
Workspace ONE UEM configuration in the VMware Identity Manager console AirWatch page.

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, select Authentication
Methods.

2 In the Password (AirWatch Connector) Configure column, click the pencil icon.

VMware, Inc. 22
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

3 Review the configuration.

Option Description

Enable AirWatch Password This check box enables Workspace ONE UEM password authentication.
Authentication

AirWatch Admin Console URL Pre-populated with the Workspace ONE UEM URL.

AirWatch API Key Pre-populated with the Workspace ONE UEM Admin API key.

Certificate Used for Authentication Pre-populated with the Workspace ONE UEM Cloud Connector certificate.

Password for Certificate Pre-populated with the password for the Workspace ONE UEM Cloud Connector
certificate.

AirWatch Group ID Pre-populated with the organization group ID.

Number of authentication attempts The maximum number of failed login attempts when using the
allowed Workspace ONE UEM password for authentication. No more login attempts are
allowed after the failed log ins reach this number. The VMware Identity Manager
service tries to use the fallback authentication method if it is configured. The
default is five attempts.

JIT Enabled If JIT is not enabled, select this check box to enable just-in-time provisioning of
users in the VMware Identity Manager service dynamically when they log in the
first time.

4 Click Save.

Configure Built-in Identity Providers

You can configure multiple built-in identity providers and associate authentication methods that have been
configured in the Identity & Access Management Manage > Auth Methods page.

Procedure

1 In the Identity & Access Management tab, go to Manage > Identity Providers.

2 Click Add Identity Provider, and select Create Built-in IDP.

Option Description

Identity Provider Name Enter the name for this built-in identity provider instance.

Users Select which users to authentication. The configured directories are listed.

Network The existing network ranges configured in the service are listed. Select the
network ranges for the users based on the IP addresses that you want to direct to
this identity provider instance for authentication.

Authentication Methods The authentication methods that are configured on the service are displayed.
Select the check box for the authentication methods to associate to this built-in
identity provider.
For Device Compliance (with Workspace ONE UEM) and Password (AirWatch
Connector), make sure that the option is enabled in the AirWatch configuration
page.

3 Click Add.

VMware, Inc. 23
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

What to do next

Configure the default access policy rule to add the authentication policy to the rule. See Configure
Compliance Checking Rules

VMware, Inc. 24
Implementing Mobile Single
Sign-in Authentication for
Workspace ONE UEM -Managed
iOS Devices 3
For iOS device authentication, VMware Identity Manager uses an identity provider that is built in to the
VMware Identity Manager service to provide access to mobile SSO authentication.

This authentication method for iOS devices uses a Key Distribution Center (KDC) without the use of a
connector or a third-party system. Kerberos authentication provides users, who are successfully signed in
to their domain, access to their Workspace ONE apps portal without additional credential prompts.

This chapter includes the following topics:

n Implementation Overview to Configure Mobile SSO for iOS

n Configure Active Directory Certificate Authority in Workspace ONE UEM

n Using Workspace ONE UEM Certificate Authority for Kerberos Authentication

n Using a Key Distribution Center for Authentication from iOS Devices

n Configure Mobile SSO for iOS Authentication

n Configure Built-in Identity Provider for Mobile SSO iOS Authentication

n Configure Apple iOS Profile in Workspace ONE UEM Using Active Directory Certificate Authority
and Certificate Template

n Configure Apple iOS Profile in Workspace ONE UEM Using Workspace ONE UEM Certificate
Authority

n Assign a Workspace ONE UEM Device Profile

Implementation Overview to Configure Mobile SSO for

iOS
Implementing Mobile SSO authentication for Workspace ONE UEM-managed iOS 9 or later devices
requires the following configuration steps.

n Download the issuer certificate to configure Mobile SSO for iOS

n If you are using Active Directory Certificate Services, configure a certificate authority template for
Kerberos certificate distribution in the Active Directory Certificate Services. Then configure
Workspace ONE UEM to use Active Directory Certificate Authority. Add the Certificate template in
the Workspace ONE UEM console. Download the issuer certificate to configure Mobile SSO for
iOS.

VMware, Inc. 25
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n If you are using Workspace ONE UEM Certificate Authority, enable Certificates in the
VMware Identity Manager Integrations page. Download the issuer certificate to configure Mobile
SSO for iOS.

n Establish the Key Distribution Center (KDC) to use.

n Configure the iOS device profile and enable single sign-in from the Workspace ONE UEM console.

n Configure the Mobile SSO (iOS) authentication method

n Configure the built-in identity provider and associate the Mobile SSO for iOS authentication in the
VMware Identity Manager console.

Configure Active Directory Certificate Authority in

Workspace ONE UEM
To set up single sign-on authentication to Workspace ONE UEM managed iOS 9 mobile devices, you can
set up a trust relationship between Active Directory and Workspace ONE UEM and enable the Mobile
SSO for iOS authentication method in VMware Identity Manager.

After you configured the certificate authority and certificate template for Kerberos certificate distribution in
the Active Directory Certificate Services, you enable Workspace ONE UEM to request the certificate used
for authentication and add the certificate authority to the Workspace ONE UEM console.

Procedure

1 In the Workspace ONE UEM console main menu, navigate to Devices > Certificates > Certificate
Authorities.

2 Click Add.

3 Configure the following in the Certificate Authority page.

Note Make sure that Microsoft AD CS is selected as the Authority Type before you start to complete
this form.

Option Description

Name Enter a name for the new Certificate Authority.

Authority Type Make sure that Microsoft ADCS is selected.

Protocol Select ADCS as the protocol.

Server Hostname Enter the URL of the server. Enter the hostname in this format
https://{servername.com}/certsrv.adcs/. The site can be http or https
depending on how the site is set up. The URL must include the trailing /.

Note If the connection fails when you test the URL, remove the http:// or https://
from the address and test the connection again.

Authority Name Enter the name of the certificate authority that the ADCS end point is connected
to. This name can be found by launching the Certification Authority application on
the certificate authority server.

VMware, Inc. 26
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Option Description

Authentication Make sure that Service Account is selected.

Username and Password Enter the user name and password of the AD CS admin account with sufficient
access to allow Workspace ONE UEM to request and issue certificates.

4 Click Save.

What to do next

Configure the Certificate Template in Workspace ONE UEM.

Configuring Workspace ONE UEM to use Active Directory

Certificate Authority
Your certificate authority template must be properly configured for Kerberos certificate distribution. In the
Active Directory Certificate Services (AD CS), you can duplicate the existing Kerberos Authentication
template to configure a new certificate authority template for the iOS Kerberos authentication.

When you duplicate the Kerberos Authentication template from AD CS, you must configure the following
information in the Properties of New Template dialog box.

Figure 3‑1. Active Directory Certificate Services Properties of New Template Dialog Box

n General tab. Enter the Template display name and the Template name. For example iOSKerberos.
This is the display name that is shown in the Certificate Templates snap-in, Certificates snap-in, and
Certification Authority snap-in.

n Request Handling tab. Enable Allow private key to be exported.

n Subject Name tab. Select Supply in the request radio button. The subject name is supplied by
Workspace ONE UEM when Workspace ONE UEM requests the certificate.

n Extensions tab. Define the application policies.

n Select Applications Policies and click Edit to add a new application policy. Name this policy
Kerberos Client Authentication.

n Add the object identifier (OID) as follows: 1.3.6.1.5.2.3.4. Do not change.

n In the Description of Application Policies list delete all policies listed except for the Kerberos
Client Authentication policy and the Smart Card Authentication policy.

VMware, Inc. 27
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n Security tab. Add the Workspace ONE UEM account to the list of users that can use the certificate.
Set the permissions for the account. Set Full Control to allow the security principal to modify all
attributes of a certificate template, including the permissions for the certificate template. Otherwise,
set the permissions according to your organization's requirements.

Save the changes. Add the template to the list of templates used by the Active Directory Certificate
Authority.

In Workspace ONE UEM configure the Certificate Authority and add the Certificate Template.

Add Certificate Template in Workspace ONE UEM

You add the certificate template that associates the certificate authority used to generate the user's
certificate.

Prerequisites

Configure the Certificate Authority in Workspace ONE UEM.

Procedure

1 In the Workspace ONE UEM console, navigate to System > Enterprise Integration > Certificate
Authorities.

2 Select the Request Template tab and click Add.

3 Configure the following in the certificate template page.

Option Description

Name Enter the name for the new request template in Workspace ONE UEM.

Certificate Authority In the drop-down menu, select the certificate authority that was created.

Issuing Template Enter the Microsoft CA certificate template name exactly as you created in AD
CS. For example, iOSKerberos.

Subject Name Enter the Subject name for the template. You can click + to select a lookup value
from the list. Make sure that the value is entered after CN= in the text box. If you
select the lookup type DeviceUid, enter a colon (:) after the value and select the
lookup value from the list. For example, CN={DeviceUid}:{lookupvalue}, where
the {} text box is the Workspace ONE UEM lookup value. Make sure to include
the colon (:). The text entered in this text box is the Subject of the certificate,
which can be used to determine who or what device received the certificate.

Private Key Length This private key length matches the setting on the certificate template that is
being used by AD CS. It is usually 2048.

Private Key Type Select the check boxes for Signing and Encryption.

SAN Type Click +Add. For the Subject Alternate Name, select User Principal Name. The
value must be {EnrollmentUser}.
When device compliance check is configured with Kerberos authentication, if you
did not configure the DeviceUid as the Subject Name lookup value, add a second
SAN type to include the device unique identifier (UDID). Select the SAN type DNS
Name. The value must be UDID={DeviceUid}.

Automatic Certificate Renewal Select the check box to have certificates that use this template automatically
renewed before their expiration date.

VMware, Inc. 28
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Option Description
Auto Renewal Period (days) Specify the auto renewal in days.

Enable Certificate Revocation Select the check box to have certificates automatically revoked when applicable
devices are unenrolled or deleted, or if the applicable profile is removed.

Publish Private Key Select this check box to publish the private key.

Private Key Destination Either Directory Service or Custom Web Service

4 Slick Save.

What to do next

In the VMware Identity Provider console, configure the built-in identity provider with the Mobile SSO for
iOS authentication method.

Using Workspace ONE UEM Certificate Authority for

Kerberos Authentication
You can use the Workspace ONE UEM Certificate Authority instead of the Active Directory Certificate
Authority to set up single sign-on with built-in Kerberos authentication to Workspace ONE UEM managed
iOS 9 mobile devices. You can enable Workspace ONE UEM Certificate Authority in the
Workspace ONE UEM console and export the CA issuer certificate for use in the
VMware Identity Manager service.

VMware, Inc. 29
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

The Workspace ONE UEM Certificate Authority is designed to follow Simple Certificate Enrollment
Protocol (SCEP) and is used with Workspace ONE UEM managed devices that support SCEP.
VMware Identity Manager integration with Workspace ONE UEM uses the Workspace ONE UEM
Certificate Authority to issue certificates to iOS 9 mobile devices as part of the profile.

The Workspace ONE UEM Certificate Authority issuer root certificate is also the OCSP signing certificate.

Enable and Export the Workspace ONE UEM Certificate Authority

When VMware Identity Manager is enabled in Workspace ONE UEM, you can generate the
Workspace ONE UEM issuer root certificate and export the certificate for use with the Mobile SSO for iOS
authentication on managed iOS 9 mobile devices.

Procedure

1 In the Workspace ONE UEM console, navigate to System > Enterprise Integration > VMware
Identity Manager.

To enable Workspace ONE UEM Certificate Authority, the organization group type must be Customer.

Tip To view or change the group type, navigate to Groups & Settings, Groups > Organization
Groups> Organization Group Details.

2 Click Configuration.

3 In the CERTIFICATE section, click Enable.

The page displays the issuer root certificate details.

4 Click Export and save the file.

What to do next

In the VMware Identity Manager console, configure Kerberos Authentication in the built-in identity
provider and add the certificate authority issuer certificate.

Using a Key Distribution Center for Authentication from

iOS Devices
For iOS device, you integrate the service with Kerberos. Kerberos authentication provides users, who are
successfully signed in to their domain, access to their application portal without additional credential
prompts. This authentication method for iOS devices uses a Key Distribution Center (KDC) without the
use of a connector or a third-party system.

VMware Identity Manager Cloud tenants do not need to manage or configure the KDC.

For on premises deployments, two KDC service options are available.

n Built-in KDC. The built-in KDC requires initializing KDC on the appliance and creating public DNS
entries to allow the Kerberos clients to find the KDC. For more information about enabling the built-in
KDC, see the VMware Identity Manager Administration guide.

VMware, Inc. 30
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n KDC as a VMware Identity Manager cloud hosted service. Using KDC in the cloud requires selecting
the appropriate realm name in the iOS authentication adapter page.

Note When the VMware Identity Manager is installed and configured with Workspace ONE UEM in a
Windows environment, the iOS Mobile authentication method must be configured to use the
VMware Identity Manager cloud hosted KDC service.

Using the Cloud Hosted KDC Service

To support using Kerberos authentication for Mobile SSO for iOS, VMware Identity Manager provides a
cloud hosted KDC service.

The KDC service hosted in the cloud must be used when the VMware Identity Manager service is
deployed with Workspace ONE UEM in a Windows environment.

To use the KDC managed in the VMware Identity Manager appliance, see the Preparing to Use Kerberos
Authentication on iOS devices in the VMware Identity Manager Installation and Configuration Guide.

When you configure Mobile SSO for iOS authentication, you configure the realm name for the cloud
hosted KDC service. The realm is the name of the administrative entity that maintains authentication data.
When you click Save, the VMware Identity Manager service is registered with the cloud hosted KDC
service. The data that is stored in the KDC service is based on your configuration of the Mobile SSO for
iOS authentication method, which includes the CA certificate, the OCSP signing certificate, and the
OCSP request configuration details.

The logging records are stored in the cloud service. The Personally Identifiable Information (PII) in the
logging records include the Kerberos principal name from the user's profile, the subject DN and UPN and
email SAN values, the device ID from the user's certificate, and the FQDN of the IDM service that the
user is accessing.

To use the cloud hosted KDC service, VMware Identity Manager must be configured as follows.

n The FQDN of the VMware Identity Manager service must be reachable from the Internet. The
SSL/TLS certificate used by VMware Identity Manager must be publicly signed.

n An outbound request/response port 88 (UDP) and port 443 (HTTPS/TCP) must be accessible from
the VMware Identity Manager service.

n If you enable OCSP, the OCSP responder must be reachable from the Internet.

Configure Mobile SSO for iOS Authentication

You configure the Mobile SSO for iOS authentication method from the Authentication Methods page in the
VMware Identity Manager console. Select the Mobile SSO (for iOS) authentication method to use in the
built-in identity provider.

Prerequisites

n Certificate authority PEM or DER file used to issue certificates to users in the Workspace ONE UEM
tenant.

VMware, Inc. 31
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n For revocation checking, the OCSP responder's signing certificate.

n For the KDC service, select the realm name of the KDC service. If using the built-in KDC service, the
KDC must be initialized. See the Installing and Configuring VMware Identity Manager for the built-in
KDC details.

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, go to Manage >
Authentication Methods.

2 In the Configure column forMobile SSO (for iOS), click the pencil icon.

3 Configure the Kerberos authentication method.

Option Description
Enable KDC Authentication Select this check box to enable users to sign in using iOS devices that support
Kerberos authentication.

Realm For tenant deployments in the cloud , the realm value is read-only. The realm
name displayed is the identity manager realm name for your tenant.
In an on-premises deployments, if you are using the cloud hosted KDC, enter the
pre-defined supported realm name that is supplied to you. The text in this
parameter must be entered in all caps. For example,
OP.VMWAREIDENTITY.COM. If you are using the built-in KDC, the realm name
that you configured when you initialized the KDC displays.

Root and Intermediate CA Certificate Upload the certificate authority issuer certificate file. The file format can be either
PEM or DER.

Uploaded CA Certificate Subject DNs The content of the uploaded certificate file is displayed here. More than one file
can be uploaded and whatever certificates that are included are added to the list.

Enable OCSP Select the check box to use the Online Certificate Status Protocol (OCSP)
certificate validation protocol to get the revocation status of a certificate.

Send OCSP Nonce Select this check box if you want the unique identifier of the OCSP request to be
sent in the response.

OCSP Responder’s Signing Certificate Upload the OCSP certificate for the responder.
When you are using the Workspace ONE UEM Certificate Authority, the issuer
certificate is used as the OCSP certificate. Upload the Workspace ONE UEM
certificate here as well.

OCSP Responder’s Signing Certificate The uploaded OCSP certificate file is listed here.
Subject DN

Cancel Message Create a custom sign-in message that displays when authentication is taking too
long. If you do not create a custom message, the default message is Attempting
to authenticate your credentials.

VMware, Inc. 32
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Option Description
Enable Cancel Link When authentication is taking too long, give users the ability to click Cancel to
stop the authentication attempt and cancel the sign-in.
When the Cancel link is enabled, the word Cancel appears at the end of the
authentication error message that displays.

Enterprise Device Management Server Enter the Mobile Device Management (MDM) server URL to redirect users when
URL access is denied because the device is not enrolled into Workspace ONE UEM
for MDM management. This URL displays in the authentication failure error
message. If you do not enter a URL here, the generic Access Denied message
displays.

4 Click Save.

What to do next

n Associate the Mobile SSO (for iOS) authentication method in the built-in identity provider.

Configure Built-in Identity Provider for Mobile SSO iOS

Authentication
You configure the built-in identity provider and associate the Mobile SSO for iOS authentication method
that has been configured in the Identity & Access Management Manage > Auth Methods page.

Prerequisites

Mobile SSO (for iOS) authentication configured in the Authentication Methods page.

Procedure

1 In the Identity & Access Management tab, go to Manage > Identity Providers.

2 Click Add Identity Provider, and select Create Built-in IDP.

Option Description

Identity Provider Name Enter the name for this built-in identity provider instance.

Users Select which users to authentication. The configured directories are listed.

Network The existing network ranges configured in the service are listed. Select the
network ranges for the users based on the IP addresses that you want to direct to
this identity provider instance for authentication.

Authentication Methods The authentication methods that are configured on the service are displayed.
Select the check box for the iOS authentication method to associate to this built-in
identity provider. Add any other authentication methods.
For Device Compliance (with Workspace ONE UEM) and Password
(Workspace ONE UEM Connector), make sure that the option is enabled in the
Workspace ONE UEM configuration page.

3 In the KDC Certificate Export section, click Download Certificate. Save this certificate to a file that
can be access from the Workspace ONE UEM console.

You upload this certificate when you configure the iOS device profile in Workspace ONE UEM.

VMware, Inc. 33
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

4 Click Add.

What to do next

n Configure the default access policy rule for Kerberos authentication for iOS devices. Make sure that
this authentication method is the first method set up in the rule.

n Go to the Workspace ONE UEM console and configure the iOS device profile in
Workspace ONE UEM and add the KDC server certificate issuer certificate from
VMware Identity Manager.

Configure Apple iOS Profile in Workspace ONE UEM

Using Active Directory Certificate Authority and
Certificate Template
Create and deploy the Apple iOS device profile in Workspace ONE UEM to push the Identity Provider
settings to the device. This profile contains the information necessary for the device to connect to the
VMware Identity Provider and the certificate that the device used to authenticate. Enable single sign-on to
allow seamless access without requiring authentication into each app.

Prerequisites

n Mobile SSO for iOS is configured in VMware Identity Manager.

n iOS Kerberos certificate authority file saved to a computer that can be accessed from the
Workspace ONE UEM admin console.

n Your Certificate Authority and Certificate Template is properly configured in Workspace ONE UEM.

n List of URLs and application bundle IDs that use Mobile SSO for iOS authentication on iOS devices.

Procedure

1 In the Workspace ONE UEM console, navigate to Devices >Profiles & Resources > Profiles .

2 Select Add > Add Profile and select Apple iOS.

3 Enter the name as iOSKerberos and configure the General settings.

4 In the left navigation pane, select Credentials > Configure to configure the credential.

Option Description

Credential Source Select Defined Certificate Authority from the drop-down menu.

Certificate Authority Select the certificate authority from the list in the drop-down menu.

Certificate Template Select the request template that references the certificate authority from the drop-
down menu. This is the certificate template created in Adding the Certificate
Template in Workspace ONE UEM.

5 Click + in the lower right corner of the page again and create a second credential.

6 In the Credential Source drop-down menu, select Upload.

7 Enter a credential name.

VMware, Inc. 34
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

8 Click Upload to upload the KDC server root certificate that is downloaded from the Identity & Access
Management > Manage > Identity Providers > Built-in Identity provider page.

9 In the left navigation pane, select Single Sign-On and click Configure.

10 Enter the connection information.

Option Description

Account Name Enter Kerberos.

Kerberos Principal Name Click + and select {EnrollmentUser}.

Realm For tenant deployments in the cloud, enter the Identity Manager realm name for
your tenant. The text in this parameter must be capitalized. For example,
VMWAREIDENTITY.COM.
For on premises deployments, enter the realm name you used when you
initialized KDC in the VMware Identity Manager appliance. For example,
EXAMPLE.COM

Renewal Certificate Select Certificate #1 from the drop-down menu. This is the Active Directory CA
cert that was configured first under credentials.

URL Prefixes Enter the URL prefixes that must match to use this account for Kerberos
authentication over HTTP.
For tenant deployments in the cloud, enter the VMware Identity Manager server
URL as https://<tenant>.vmwareidentity.<region>.
For on premises deployments, enter the VMware Identity Manager server URL as
https://myco.example.com.

Applications Enter the list of application identities that are allowed to use this sign-on. To
perform single sign-on using iOS built-in Safari browser, enter the first application
bundle ID as com.apple.mobilesafari. Continue to enter application bundle
IDs. The applications listed must support SAML authentication.

11 Click Save & Publish.

What to do next

Assign the device profile to a smart group. Smart groups are customizable groups that determine which
platforms, devices, and users receive an assigned application, book, compliance policy, device profile, or
provision.

Configure Apple iOS Profile in Workspace ONE UEM

Using Workspace ONE UEM Certificate Authority
Create and deploy the Apple iOS device profile in Workspace ONE UEM to push the Identity Provider
settings to the device. This profile contains the information necessary for the device to connect to the
VMware Identity Provider and the certificate that the device uses to authenticate.

Prerequisites

n Built-in Kerberos configured in VMware Identity Manager.

n VMware Identity Manager KDC server root certificate file saved to a computer that can be accessed
from the Workspace ONE UEM console.

VMware, Inc. 35
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n Certificate enabled and downloaded from the Workspace ONE UEM console System > Enterprise
Integration > VMware Identity Manager page.

n List of URLs and application bundle IDs that use Built-in Kerberos authentication on iOS devices.

Procedure

1 In the Workspace ONE UEM console, navigate to Devices > Profiles & Resources > Profile > Add
Profile and select Apple IOS.

2 Configure the profile’s General settings and enter the name of the device as iOSKerberos.

3 In the left navigation pane, select SCEP > Configure to configure the credential.

Option Description

Credential Source Select AirWatch Certificate Authority from the drop-down menu.

Certificate Authority Select the AirWatch Certificate Authority from the drop-down menu.

Certificate Template Select Single Sign On to set the type of certificate that is issued by the AirWatch
Certificate Authority.

4 Click Credentials > Configure and create a second credential.

5 In the Credential Source drop-down menu, select Upload.

6 Enter the iOS Kerberos credential name.

7 Click Upload to upload the VMware Identity Manager KDC server root certificate that is downloaded
from the Identity & Access Management > Manage > Identity Providers > Built-in Identity provider
page.

8 In the left navigation pane, select Single Sign-On.

9 Enter the connection information.

Option Description

Account Name Enter Kerberos.

Kerberos Principal Name Click + and select {EnrollmentUser}.

Realm For tenant deployments in the cloud, enter the VMware Identity Manager realm
name for your tenant. The text in this parameter must be capitalized. For
example, VMWAREIDENTITY.COM.
For on premises deployments, enter the realm name you used when you
initialized KDC in the VMware Identity Manager machine. For example,
EXAMPLE.COM.

Renewal Certificate On iOS 8 and later devices, select the certificate used to reauthenticate the user
automatically without any need for user interaction when the user's single sign-on
session expires.

VMware, Inc. 36
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Option Description

URL Prefixes Enter the URL prefixes that must match to use this account for Kerberos
authentication over HTTP.
For tenant deployments in the cloud, enter the VMware Identity Manager server
URL as https://<tenant>.vmwareidentity.<region>.
For on premises deployments, enter the VMware Identity Manager server URL as
https://myco.example.com.

Applications Enter the list of application identities that are allowed to use this sign-in. To
perform single sign-on using iOS built-in Safari browser, enter the first application
bundle ID as com.apple.mobilesafari. Continue to enter application bundle
IDs. The applications listed must support SAML authentication.

10 Click Save & Publish.

When the iOS profile is successfully pushed to users' devices, users can sign in to
VMware Identity Manager using the Built-in Kerberos authentication method without entering their
credentials.

What to do next

Assign the device profile to a smart group. Smart groups are customizable groups that determine which
platforms, devices, and users receive an assigned application, book, compliance policy, device profile, or
provision.

Assign a Workspace ONE UEM Device Profile

After you create a device profile, you assign the profile to a smart group.

Smart groups are customizable groups that determine which platforms devices, and users receive an
assigned application, compliance policy, device profile, or provision. See the Workspace ONE UEM
Mobile Device Management Guide.

Procedure

1 In the Workspace ONE UEM console, navigate to Devices > Profiles & Resources > Profiles.

2 Select the device profile that you want to assign to the smart group.

3 In the General tab, click the Assigned Groups text box and select Create Assignment Group.

4 In the Create New Smart Group page, enter the name for the smart group.

5 Select Platform and Operating System and select the correct operating system and version from
the drop-down menus.

6 Click Save & Publish.

After you assign a smart group to the device option, users can sign in to Workspace ONE and access
applications from the catalog.

VMware, Inc. 37
Implementing Mobile Single
Sign-On Authentication for
Managed Android Devices 4
Mobile single sign-on (SSO) for Android is an implementation of the certificate authentication method for
Workspace ONE UEM managed Android devices. Mobile SSO allows users to sign in to their device and
securely access their Workspace ONE apps without reentering a password.
®
The VMware Tunnel mobile app is installed on the Android device to add certificate and device ID
information into authentication flows. The Tunnel settings are configured in the Workspace ONE UEM
console to access the VMware Identity Manager service for authentication, and the service retrieves the
certificate from the device for authentication.

In the Workspace ONE UEM console, you also configure the following settings.

n Android VPN profile. This profile is used to enable the per app tunneling capabilities for Android.

n Enable VPN for each app that uses the app tunnel functionality from the Workspace ONE UEM
console.

n Create network traffic rules with a list of all the apps that are configured for Per App VPN, the proxy
server details, and the VMware Identity Manager URL.

When implementing mobile SSO for Android with the VMware Identity Manager service on premises, you
configure the cert proxy service on the VMware Identity Manager machine. After the cert proxy service is
configured, you can configure certificate authentication in the VMware Identity Manager built-in identity
provider from the VMware Identity Manager console.

When implementing mobile SSO for Android with the VMware Identity Manager service in the cloud, you
can configure certificate authentication in the VMware Identity Manager built-in identity provider from the
VMware Identity Manager console. The cert proxy service is managed for you.

See the Android Mobile Single Sign-on to VMware Workspace One publication in the Workspace ONE
Documentation Center for detailed information about setting up Android Mobile SSO.

Supported Android Device

Android 5.1 or later is supported.

Applications accessed from an Android device must support SAML or another supported federation
standard for single sign-on.

VMware, Inc. 38
Direct Enrollment Using
Workspace ONE App 5
Direct enrollment through Workspace ONE requires users to enroll their devices before they can access
resources in the Workspace ONE application.

When direct enrollment is through the Workspace ONE application, you can direct all users to go to the
appropriate application store, download the Workspace ONE app, enter their email address, and follow
the prompts to begin using Workspace ONE on their devices.

Supported Devices
n Apple iOS 9.0 and later

n Android Enterprise (formerly Android for Work) 5.1 and later

n Android Legacy 4.1 and later

An Android Legacy device is any Android device that is not Android Enterprise capable, or an Android
Enterprise capable device connecting to an Workspace ONE UEM instance that does not have
Android Enterprise enabled.

This chapter includes the following topics:

n Enable Workspace ONE for Direct Enrollment

n User Experience When Directly Enrolling into Workspace ONE UEM with Workspace ONE

Enable Workspace ONE for Direct Enrollment

You enable direct device enrollment through Workspace ONE from the Workspace ONE UEM console
Enrollment > Restriction page for your organization group (OG).

When Workspace ONE is enabled for direct enrollment, qualified devices logging in for the first time are
directly enrolled. Devices that do not qualify for direct enrollment are granted mobile application
management-only access in a Workspace ONE registered state.

Procedure

1 In the Workspace ONE UEM console, select the organization group to enable Direct Enrollment for
Workspace ONE.

2 Navigate to Groups & Settings > All Settings > Device & Users > General > Enrollment and
select the Restrictions tab.

VMware, Inc. 39
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

3 For Current Settings, select Override if required.

4 Scroll down to the Management Requirements for Workspace ONE and select the configuration
options.

Setting Description

Require MDM for When this is enabled, qualified devices and users are prompted to enroll immediately upon
Workspace ONE login to Workspace ONE.

Assigned User Group All Users is the default user group. You can select a specific user group to include in the
direct enrollment process.

iOS Enable to include iOS devices. iOS devices are not eligible for direct enrollment if this is
disabled. If this is disabled, devices can still register in Workspace ONE UEM in an
unmanaged state.

Android Legacy Enable to include Android Legacy devices. Android Legacy devices are not eligible for direct
enrollment if this is disabled. If this is disabled, devices can still register in
Workspace ONE UEM in an unmanaged state.

Android Enterprise Enable to include Android Enterprise devices. Android Enterprise devices are not eligible for
direct enrollment if this is disabled. If this is disabled, devices can still register in
Workspace ONE UEM in an unmanaged state.

5 Click Save.

6 Continue to configure the enrollment tabs with the enrollment options supported for Workspace ONE.
See Workspace ONE Direct Enrollment Configuration Options.

For more information about configuring Direct Enrollment for Workspace ONE, see the VMware
AirWatch Mobile Device Management Guide, Device Enrollment chapter.

Workspace ONE Direct Enrollment Configuration Options

Configure direct enrollment with Workspace ONE in the Workspace ONE UEM console. Navigate to
Groups & Settings > All Settings > Device & Users/General/Enrollment. The Workspace ONE Device
Enrollment Options Table lists the menu items that can be configured.

The Enrollment settings page lets you configure options related to device and user enrollment. The page
is divided into tabs which are described below. For detailed information about configuring device
enrollment, see the VMware Workspace ONE UEM Mobile Device Management guide.

Figure 5‑1. Workspace ONE UEM Console Enrollment Page

VMware, Inc. 40
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Table 5‑1. Workspace ONE Direct Enrollment Configurable Menu Items

Enrollment Tab Configurable Menu Items for Direct Enrollment to Workspace ONE

Authentication Directory users are supported.

In addition, SAML plus Active Directory Users are supported "on-the-fly".
SAML without LDAP users are supported when the user record exists in
Workspace ONE UEM at the time of the initial login.
For Devices Enrollment Mod, only Open Enrollment is supported.
Registered Devices Only is not supported.

Terms of Use Terms of use can be created to require users accept the terms of use before
proceeding with the direct enrollment process.

Grouping All grouping menu options are compatible with Workspace ONE direct
enrollment.
Sync Users Groups in Real Time for Workspace ONE is enabled by
default. When a device is enrolling, Workspace ONE UEM makes a real time
call to Active Directory to sync the user's user groups. If the user does not
exist in Workspace ONE UEM, the Workspace ONE UEM console first syncs
the user and then syncs the user groups in real time. If this feature is not
enabled, the Workspace ONE UEM console does not sync the user groups.

Note This feature is CPU-intensive. If user groups are not frequently

changing or the user groups already exist in Workspace ONE UEM, disable
this setting for improved performance and to prevent latency issues when
launching the Workspace ONE app.

See Placing Devices in the Correct Organization Group section in

Deployment Strategies for Setting Up Multiple Workspace ONE UEM
Organization Groups.

Restrictions n In User Access Control, you can select both Restrict Enrollment to
Known Users and Restrict Enrollment to Configured Groups.
n Maximum device limit is supported.
n Policy Setting is partially supported.
n Allowed Ownership Types. Workspace ONE only prompts for
Employee Owned and Corporate - Dedicated.

Note Container Allow enrollment type is not supported.

Optional Prompt The two optional prompts that can be enabled are Prompt for Ownership
Type and Enable Device Asset Number Prompt. The request to enter the
asset number is only prompted for when the ownership type is Corporate
Owned.

Customization Customization menu options supported.

n Post-Enrollment Landing URL (iOS only)
n MDM Profile Message (iOS only)
n Use Custom MDM Applications
Use specific Message Template for each Platform can be enabled, but
specific Workspace ONE message templates are not available for
Workspace ONE 3.2.

VMware, Inc. 41
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

User Experience When Directly Enrolling into

Workspace ONE UEM with Workspace ONE
When mobile device management is implemented through Workspace ONE, users download the
Workspace ONE application, authenticate with Workspace ONE UEM, and enroll their device. After the
device is enrolled, users can use Workspace ONE to add and use their entitled resources immediately.

The process users experience when using Workspace ONE to enroll their devices is similar for iOS and
Android Enterprise devices. Android Legacy enrollment is redirected to the AirWatch Agent for enrollment.
AirWatch Agent automatically hands control back to Workspace ONE when enrollment is complete. Users
can access Workspace ONE in each of these variations.

Direct Enrollment Through Workspace ONE on iOS Devices

Direct users to download, install, and run the Workspace ONE application from the Apple App store.

Procedure

1 Users open the app, enter their server URL and email address, and authenticate according to the
configuration for their environment.

2 The Additional setup is required by your company screen displays.

Figure 5‑2. Notification of Setting up Device Enrollment

3 If Terms of Use is configured, users are asked to accept the terms of use before proceeding.

VMware, Inc. 42
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

4 If you set up the optional prompts to show the device ownership type and request the device asset
number, this information is displayed.

Figure 5‑3. Device Ownership Selection

5 Safari is opened and users click Allow to open the Settings page.

Figure 5‑4. Allow Configuration Profile Settings

The Workspace Services and configuration profile are configured on the device.

The device is now enrolled in Workspace ONE UEM and Workspace ONE is launched. The
Recommended for You screen is displayed.

VMware, Inc. 43
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Figure 5‑5. Recommended Applications Screen

6 Users can select the applications they want to install or they can skip this step for now.

The device is now managed by Workspace ONE UEM MDM. If recommended applications were selected
to be installed, users begin to receive push notifications for those applications.

Direct Enrollment Using Workspace ONE on Android Enterprise

Devices
Direct users to download, install, and run the Workspace ONE application from the Google App Store or
the repository.

Procedure

1 Users enter their server URL and email address, and authenticate according to the configuration for
their environment.

VMware, Inc. 44
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

2 The Additional setup is required by your company screen displays. The user clicks Continue.

Figure 5‑6. Notification of Setting up Device Enrollment

3 If Terms of Use is configured, users are asked to accept the terms of use before proceeding.

4 If you set up the optional prompts to show the device ownership type and request the device asset
number, this information is displayed.

5 The Workspace Services and work profile are configured on the device.

Figure 5‑7. Set Up Work Profile Notification

Users see a message describing device management control with this work profile and click OK.

The Workspace ONE application is installed and the Android Work Account is registered.

VMware, Inc. 45
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

6 The device is now enrolled in Workspace ONE UEM and Workspace ONE is launched. The
Recommended for You screen is displayed.

Figure 5‑8. Recommended Applications Screen

7 Users can select which applications they want to install or skip this step for now.

The device is now managed by Workspace ONE UEM MDM. If recommended applications were selected
to be installed, those applications begin to be installed with a badged Android Enterprise briefcase icon.

Device Enrollment for Android Legacy Devices

Device enrollment for Android Legacy devices redirects to the AirWatch Agent for enrollment. AirWatch
Agent automatically hands control back to Workspace ONE when the enrollment is complete.

Direct users to go to the application store to download Workspace ONE.

Procedure

1 Users open the app, enter either their server URL or email address and enter their user name and
password to sign in.

At this point, the Workspace ONE application can detect that the device is not enabled for Android
Enterprise and if the device requires direct enrollment before resources on Workspace ONE can be
accessed.

VMware, Inc. 46
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

2 The Additional setup is required by your company screen displays and when users click
Proceed, they are redirected to the AirWatch Agent application in the Google Play Store.

Figure 5‑9. AirWatch Agent Application Download Request

3 Users download the AirWatch Agent application.

Note If the AirWatch Agent application is already installed on the device, Workspace ONE
automatically launches the application. They are not redirected to the app store.

The authentication details that were entered for Workspace ONE are passed to the AirWatch Agent
application so users do not reenter this information.

The AirWatch Agent application is launched. During the device enrollment with the AirWatch agent,
users select the ownership type and enter the device asset number, if configured.

4 When Allow Agent to make and mange phone calls displays, users click Allow.

AirWatch Agent validates the enrollment, authenticates the user, and grants permissions to AirWatch
on this device.

VMware, Inc. 47
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

5 When the Activate device admin app? screen displays, users click Activate this device admin
app.

Figure 5‑10. Activate Device Admin App

6 Users are asked to grant permission to access various device capabilities.

The device is now enrolled in Workspace ONE UEM and Workspace ONE is launched. The
Recommended applications screen is displayed.

Figure 5‑11. Recommended Applications Screen

7 Users can select the applications they want to install or they can skip this step for now.

VMware, Inc. 48
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

The device is now managed by Workspace ONE UEM MDM. If recommended applications were selected
to be installed, users begin to receive notifications for those applications.

VMware, Inc. 49
Applying Workspace ONE to
Support Apple Device
Enrollment Program Integration 6
The Apple Device Enrollment Program (DEP) does not support scenarios where a customer is using
SAML for user authentication. However Workspace ONE has implemented a unique way to support this
use case.

Through Workspace ONE UEM device staging, admins can assign the device to a multi-device staging
user and allow Workspace ONE to reassign the device the appropriate user when they sign in to the
Workspace ONE application.

The Workspace ONE application must be installed on the device as part of the staging user enrollment.
When users sign in to Workspace ONE the first time, Workspace ONE authenticates the user through the
configured SAML provider. After the user is authenticated, the ownership of the device is switched from
the multi-device staging user to the authenticated directory user.

Prerequisite
The directory user must exist in Workspace ONE UEM when the user signs in to the Workspace ONE
application. You can pre-load users in a bulk load through CSV or apply the following API to generate
users on an as needed basis.

Note The Security Type value must equal the directory.

https://<API_SERVER_ADDRESS>/api/help/#!/apis/10006?!/User/User_AddUser

Flow for Workspace ONE Support of DEP Integration

The following tasks must be completed to implement support of the Apple Device Enrollment Program
using Workspace ONE.

n Install the Workspace ONE application on the iOS devices.

n Ensure that a staging user exists with the following staging configuration in the Workspace ONE UEM
console.
a Navigate to Accounts > Users > List View and select the user account for which you want to
enable device staging to edit.

VMware, Inc. 50
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

b In the Add/Edit User page, select the Advanced tab. Scroll down to the Staging section and
enable Device Staging and Multi User Devices.

Figure 6‑1. Multi User Devices Setting in Workspace ONE UEM

n Assign the device to the staging user in the Apple DEP portal and deliver the device to the end user.

For more information about the Apple Device Enrollment Program, see the Apple Device Enrollment
guide.

How the Integration Works

When the user turns on the device the first time, the device is enrolled and assigned to the multi-device
staging user. The user launches the Workspace ONE application that is available on the home screen
and signs in. Workspace ONE authenticates the user through the configured SAML provider.

After the user is authenticated, the ownership of the device is switched from the multi-device staging user
to the authenticated directory user. Applications, profiles, and resources assigned to the authenticated
user are pushed to the device.

Note The organization group of the device does not change. This feature does not support user group
mapping (or manual user selection based on drop-down menu) located in the Enrollment Setting section
of the Workspace ONE UEM console.

VMware, Inc. 51
Deploying the VMware
Workspace ONE Mobile
Application 7
When the VMware Workspace ONE application is installed on mobile devices, users can access the
resources that you authorized for their use.

Users can access their entitled applications using single sign-on functionality when their identities are
managed with VMware Identity Manager. They also can access an app catalog where they can add other
applications.

The Workspace ONE application interface offers a similar experience and options on any smart phone,
tablet, or desktop computer.

If the device is enrolled in mobile device management (MDM), you can push the Workspace ONE
application as a managed application.

This chapter includes the following topics:

n Device Management Options in Workspace ONE UEM for Public and Internal Apps for Workspace
ONE

n Managing Access to Applications

n Requiring Terms of Use to Access the Workspace ONE Catalog

n Getting and Distributing the Workspace ONE Application

n Registering Email Domains for Auto Discovery

n Session Authentication Setting

n Deployment Strategies for Setting Up Multiple Workspace ONE UEM Organization Groups

Device Management Options in Workspace ONE UEM for

Public and Internal Apps for Workspace ONE
You can configure to deploy public and internal applications based on the device management status.
Any device can access applications that are configured as open access. Only devices that are granted
permission, either by being enabled through the Workspace Services or Agent Enrollment, can access
applications that are configured for managed access.

The table outlines capabilities for both managed and unmanaged scenarios.

VMware, Inc. 52
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Access
Type Features Description Suggested Uses

Open n Self-service app catalog for Users access resources on their n Provide application access to end-
Access Web, Horizon, and Citrix device without granting admins users immediately upon login,
(unmanaged resources permission to access their device. without elevated security
) n Launch web/virtual with The applications with open access permissions.
single sign-on (SSO) are available to devices no matter n Recommend the use of an
n Touch ID / PIN application their managed status. Admins application without requiring that
protection cannot systematically remove the application be installed. Users
native applications when they are can install the application on their
n Device jailbreak detection
set to Open Access. device when they want.
n Support for VMware Identity
n Applications do not contain
Manager conditional
sensitive corporate data and do not
access, including
access protected corporate
authentication policies and
resources.
blocking devices.
n To distribute applications to
n Native application access.
auxiliary personnel without the
n Internal App and SDK app
Workspace ONE UEM MDM
distribution.
profile.

Managed n Self-service app catalog for Users install a management profile n To remove sensitive corporate data
Access Web, Horizon, and Citrix on their device to grant admins from devices when users leave the
resources permission to access their device. organization or lose their device.
n Launch web/virtual with Applications with managed access n Require app tunneling to
single sign-on (SSO) are available to devices that authenticate and securely
n Touch ID / PIN application Workspace ONE UEM manages. communicate with internal back-
protection If Workspace ONE UEM does not end resources when applications
manage the device, Workspace access the intranet.
n Device jailbreak detection
ONE prompts the user on the n Enable single sign-on for
n Support for VMware Identity
device to enroll with applications.
Manager conditional
Workspace ONE UEM. If the n Track user adoption and installation
access, including
device is enrolled, the user can use status for applications.
authentication policies and
the device to access the
blocking devices. n Deploy the application
application through Workspace
n Managed and direct automatically upon enrollment.
ONE.
installation of Native Apps
n Internal App and SDK app
management.
n Support for app
configuration
n Per-app VPN
n One Touch SSO for SAML
enabled native apps
n Device profiles
n Workspace ONE UEM
compliance engine

For information on where to configure managed access options for internal applications or how to add
public application for deployment through Workspace ONE, see the Workspace ONE UEM Mobile
Application Management Guide.

VMware, Inc. 53
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Supported Platforms for Open and Managed Access

Configure the access type for internal and public applications based on the platform.

Managed Access Open Access

INTERNAL APPLICATIONS

Android X X

iOS X X

Windows 10 Desktop X -

Windows 10 Phone X -

PUBLIC APPLICATIONS

Android X X

iOS X X

Windows 10 Desktop - X

Windows 10 Phone - X

Managing Access to Applications

A single user might be entitled to a mix of open or managed access to native apps. The adaptive
management approach allows for end users to use open access applications without requiring
management. When users request a native app that requires management, adaptive management
provides the additional security and control needed to manage that native app.

When applications are managed, users must enable Workspace Services to install and use the managed
applications. When you upload an application in the Workspace ONE UEM console, the access state
displays as either open or managed based on configuration for that application. For example, if the Send
App Configuration option is selected, an application is set to require management.

Applications that require management display a star icon when viewed in an unmanaged state in the
catalog. Users must select to enable Workspace services through the adaptive management process to
use the application. When users attempt to download an application that displays a star icon, they are
prompted with a message that asks users to enable the Workspace Services. Users can click a privacy
notice link to see the privacy impact for their personal information if they choose to continue with the
adaptive management process. The privacy notice automatically pulls settings from the
Workspace ONE UEM environment they are about to enroll into. After reviewing the privacy setting
information, users can either proceed to enable Workspace Services or back out and continue to use the
Workspace ONE application unmanaged on their device. When users enable Workspace Services, the
star icon is removed from all the managed applications.

VMware, Inc. 54
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Removing Access on Managed Devices

Users can disable the Workspace ONE app on their managed device through the Remove Account
option. Removing the account executes an enterprise wipe of the device, removing corporate access and
returning the user to the login screen. Administrators can perform an enterprise wipe from the
Workspace ONE UEM console to disable Workspace ONE services.

Executing a Remove Account action on managed devices revokes access granted through the
Workspace ONE application and unenrolls the device from Workspace ONE UEM. Applications that
required management are removed from the device and access to Workspace ONE UEM productivity
applications such as Boxer, Browser, and Content Locker, is revoked.

Requiring Terms of Use to Access the Workspace ONE

Catalog
You can write your organization's own Workspace ONE terms of use and ensure the end user accepts
this terms of use before using Workspace ONE.

The terms of use display after the user signs into Workspace ONE. Users must accept the terms of use
before proceeding to their Workspace ONE catalog.

The Terms of Use feature include the following configuration options.

n Create versions of existing terms of use.

n Edit terms of use.

n Create multiple terms of use that can be displayed based on the device type.

n Create language-specific copies of the terms of use.

The terms of use policies that you setup are listed in the Identity & Access Management tab. You can edit
the terms of use policy to make a correction to the existing policy or create a new version of the policy.
Adding a new version of the terms of use, replaces the existing terms of use. Editing a policy does not
version the terms of use.

You can view the number of users who have accepted or declined the terms of use from the terms of use
page. Click either the accepted or declined number to see a list of users and their status.

Set Up and Enable Terms of Use

In the Terms of Use page, you add the terms of use policy and configure the usage parameters. After the
terms of use are added, you enable the Term of Use option. When users sign in to Workspace ONE, they
must accept the terms of use to access their catalog.

Prerequisites

The text of the terms of use policy formatted in HTML to copy and paste in the Terms of Use content text
box. You can add terms of use in English, German, Spanish, French, Italian, and Dutch.

VMware, Inc. 55
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, select Setup > Terms
of Use.

2 Click Add Terms of Use.

3 Enter a descriptive name for the terms of use.

4 Select Any, if the terms of use policy is for all users. To use terms up use policies by device type,
select Selected Devices Platforms and select the device types that display this terms of use policy.

5 By default, the language of the terms of use that is displayed first is based on the browser language
preference settings. Enter the terms of use content for the default language in the text box.

6 Click Save.

To add a terms of use policy in another language, click Add Language and select another language.
The Terms of Use content text box is refreshed and you can add the text in the text box.

You can drag the language name to establish the order that the terms of use are displayed.

7 To begin using the terms of use, click Enable Terms of Use on the page that displays.

What to do next

If you selected a specific device type for the terms of use, you can create additional terms of use for the
other device types.

View Status of Terms of Use Acceptance

The terms of use policies listed in the Identity & Management > Terms of Use page shows the number of
users that accepted or declined the policy.

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, select Setup > Terms
of Use.

2 In the Accepted / Decline column, click either the Accepted number on the left or the Declined
number on the right.

A status page displays the action taken, either accepted or declined, with the user name, device ID,
version of the policy viewed, platform used, and the date.

3 Click Cancel to close the view.

Getting and Distributing the Workspace ONE Application

Users can either download the VMware Workspace ONE application from their device app store or
administrators can configure Workspace ONE UEM to push the Workspace ONE application as a
managed application to devices.

VMware, Inc. 56
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

You deploy the Workspace ONE application from the Workspace ONE UEM console to specific groups
and users within your organization. After users sign into the Workspace ONE application on their devices,
they can access Web and SaaS apps that are entitled to them.

The following steps are to push the Workspace ONE mobile application as a managed application from
the Workspace ONE UEM console. You can also run the Workspace ONE Getting Started wizard to push
the application.

Note For detailed information on configuring managed applications in Workspace ONE UEM, see the
VMware Workspace ONE UEM Mobile Application Management (MAM) Guide, available from the
Resources Portal at https://resources.air-watch.com.

Prerequisites

If you are planning to push the Workspace ONE mobile application from the Workspace ONE UEM
console, prepare Smart Groups of end users who are entitled to the application.

Procedure

1 In the Workspace ONE UEM console, navigate to Apps & Books > Applications > List View >
Public, and select Add Application.

2 Select the platform, either iOS, Android, or Windows.

3 Select Search App Store, and in the Name text box enter Workspace ONE as the key word to find
VMware Workspace ONE in the App Store.

4 Choose Next, and use Select to upload the Workspace ONE application from the App Store Result
page.

5 Configure the assignment and deployment options for Workspace ONE users in the following tab
settings.

Tab Description

Info Enter and view information concerning supported device models, ratings, and
categories.

Assignment Assign the Workspace ONE mobile application to smart groups of end users who
can use the application on their device.

Deployment Configure availability and advanced enterprise mobility management (EMM)

features, if applicable.
To automatically configure managed applications, enable Send Application
Configuration and enter the App Configuration for Enterprise (ACE) key value
pairs. See Workspace ONE UEM Application Configuration for Enterprise Key
Value Pairs.

Terms of Use (Optional) Enable Terms of Use for using the Workspace ONE application.

6 Select Save & Publish to make the application available to users.

Complete these steps for each supported platform.

VMware, Inc. 57
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Workspace ONE UEM Application Configuration for Enterprise

Key Value Pairs
When deploying the Workspace ONE application as a managed application in Workspace ONE UEM and
you enable Send Application Configurations when you push the Workspace ONE app from the
Workspace ONE UEM console, you can preconfigure Workspace ONE settings that are applied when
users install and start the Workspace ONE app.

When the Workspace ONE application is uploaded to the Workspace ONE UEM console as a managed
mobile application, you can configure the VMware Workspace ONE Server URL, the device UID value,
and requirement for certificate authentication in Android devices.

Table 7‑1. Workspace ONE Managed Device Configurations Options in Workspace ONE UEM
Console
Platform Configuration Key Value Type Configuration Value Explanation

All AppServiceHost String <VMware Workspace Configures the server

ONE Server URL> URL for VMware
Workspace ONE on
devices.

iOS deviceUDID String {DeviceUid} Enter the Tracks the devices

device UID value. used to authenticate to
Do not use the Insert the VMware Identity
Lookup Value function. Manager environment.

VMware, Inc. 58
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Table 7‑1. Workspace ONE Managed Device Configurations Options in Workspace ONE UEM
Console (Continued)
Platform Configuration Key Value Type Configuration Value Explanation

iOS SkipDiscoveryScre Boolean true Beginning with the

en Workspace ONE
application version 3.1,
the
SkipDiscoveryScreen
configuration key can
be configured.
When set to True,
Workspace ONE tries
to move past the email
address/server URL
screen. When used
with the
AppServiceHost
configuration key, users
are immediately taken
to the authentication
screen. If mobile SSO
is also used, admins
can provide end users
with a seamless
experience whereby
they start Workspace
ONE and immediately
begin loading their
Workspace ONE app.

Android and iOS RemoveAccountSign Integer 0 - The Remove When the value is set
Out Account option displays to 1, the Remove
1 - The Remove Account option does
Account option does not display in the users
not display Workspace ONE
Settings page. Users
If the value is not set,
cannot remove the
the Remove Account
Workspace ONE
option is displayed.
account from their
device.
When this value is set
to 0 or no value is set,
the Remove Account
option displays. If users
click Remove Account,
Workspace ONE UEM
performs an enterprise
wipe of the device and
unenrolls the device
from
Workspace ONE UEM.

VMware, Inc. 59
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Registering Email Domains for Auto Discovery

You can register your email domain in the auto discovery service in to make it easier for end users to
access their apps portal through the Workspace ONE application. End users enter their email address
instead of the organization's URL.

When the email domain of the organization is registered for auto discovery, end users enter only their
email address in the sign-in page to access their apps portal. For example, they enter
[email protected].

When auto discovery is not used, the first time that end users open the Workspace One application, they
must provide the complete organization URL. For example, they enter myco.vmwareidentity.com.

Set up Auto Discovery in VMware Identity Manager

To register a domain, you enter your email domain and email address in the VMware Identity Manager
console Auto Discovery page.

An email message with an activation-token is sent to your email address on the domain. To activate the
domain registration, you enter the token in the Auto Discovery page and verify that the domain you
registered is your domain.

Note To set up auto discovery for VMware Identity Manager on-premises deployments, you must log in
to the VMware Identity Manager console as the local admin. You enter the Workspace ONE UEM ID and
password that you created in the Workspace ONE UEM Web site, https://secure.air-watch.com/register.

Procedure

1 In the VMware Identity Manager console, Identity & Access Management tab, click Setup > Auto
Discovery.

2 (On-premises deployments only). Configure the Workspace ONE UEM auto discovery URL.

Option Description

Auto Discovery URL Enter the URL as https://discovery.awmdm.com.

AirWatch ID Enter the email address you registered with Workspace ONE UEM to log in to their Web site.

Password Enter the password associated with the Workspace ONE UEM account.

3 In the Email Domain text box, enter your organizations email domain to register.

4 In the Confirmation Email Address text box, enter an email address on that email domain to receive
the verification token.

5 Click OK.

The status of this email domain registration is marked Pending. You can have only one pending email
domain at a time.

6 Navigate to the email and copy the activation token that is in the message.

VMware, Inc. 60
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

7 Return to the Identity & Access Management > Auto Discovery page and paste the token in the
Activation Token text box

8 Click Verify to register the domain.

The email domain is registered and is added to the list of registered email domains on the Auto Discovery
page.

End users can now enter their email address in the Workspace ONE application to access their app
portal.

What to do next

If you have more than one email domain, add another email domain to register.

Session Authentication Setting

The VMware Identity Manager service includes a default access policy that controls user access to their
VMware Identity Manager resources.

The authentication session length configured in the policy rules determine the maximum amount of time
users have since their last authentication event to access their apps launcher page or to launch a specific
Web application. The default is eight hours. After users authenticate, they have eight hours to launch a
Web application unless they initiate another authentication event that extends the time.

You can edit the default policy to change the session length from the VMware Identity Manager
administration console, Identity & Access Management tab, Manage > Policies. See the VMware Identity
Manager Administration guide, Managing Access Policies.

Enabling Compliance Checking for Workspace ONE UEM Managed

Devices
When users enroll their devices, samples containing data used to evaluate compliance are sent on a
scheduled basis. The evaluation of this sample data ensures that the device meets the compliance rules
set by the administrator in the Workspace ONE UEM (UEM) console. If the device goes out of
compliance, corresponding actions configured in the UEM console are taken.

The VMware Identity Manager service includes an access policy option that can be configured to check
the Workspace ONE UEM server for device compliance status when users sign in from the device. The
compliance check ensures that users are blocked from signing in to an application or using single sign-in
to the Workspace ONE portal if the device goes out-of-compliance. When the device is compliant again,
the ability to sign in is restored.

The Workspace ONE application automatically signs out and blocks access to the applications if the
device is compromised. If the device was enrolled through adaptive management, an enterprise wipe
command issued through the UEM console unenrolls the device and removes the managed applications
from the device. Unmanaged applications are not removed.

For more information about Workspace ONE UEM compliance policies, see the VMware Workspace ONE
UEM Mobile Device Management Guide, in the VMware Workspace ONE UEM Documentation pages.

VMware, Inc. 61
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Deployment Strategies for Setting Up Multiple

Workspace ONE UEM Organization Groups
Workspace ONE UEM uses organization groups (OG) to identify users and establish permissions. When
Workspace ONE UEM is integrated with VMware Identity Manager, the admin and enrollment user REST
API keys are configured at the Workspace ONE UEM organization group type called Customer.

When users sign in to Workspace ONE from a device, a device registration event is triggered within
VMware Identity Manager. A request is sent to Workspace ONE UEM to pull any applications that the
user and device combination is entitled to. The request is sent using the REST API to locate the user
within Workspace ONE UEM and to place the device in the appropriate organization group.

To manage organization groups, two options can be configured in VMware Identity Manager.

n Enable Workspace ONE UEM auto discovery.

n Map Workspace ONE UEM organization groups to domains in the VMware Identity Manager service.

If neither of these two options are configured, Workspace ONE attempts to locate the user at the
organization group where the REST API key is created. That is the Customer group.

Using Workspace ONE UEM Auto Discovery

Set up Auto Discovery when a single directory is configured at a child group to the Customer
Organization Group, or when multiple directories are configured below the Customer group with unique
email domains.

Figure 7‑1. Example 1

In example 1, the email domain of the organization is registered for auto discovery. Users enter only their
email address in the Workspace ONE sign-in page.

In this example, when users in the NorthAmerica domain sign in to Workspace ONE, they enter the
complete email address as [email protected]. The application looks for the domain and verifies that
the user exists or can be created with a directory call in the NorthAmerica organization group. The device
can be registered.

VMware, Inc. 62
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Using Workspace ONE UEM Organization Group Mapping to

VMware Identity Manager Domains
Configure the VMware Identity Manager service to the Workspace ONE UEM organization group mapping
when multiple directories are configured with the same email domain. You enable Map Domains to
Multiple Organization Groups in the AirWatch configuration page in the VMware Identity Manager
console.

When the Map Domains to Multiple Organization Groups option is enabled, domains configured in
VMware Identity Manager can be mapped to the Workspace ONE UEM organization group IDs. The
admin REST API key is also required.

In example 2, two domains are mapped to different organization groups. An admin REST API key is
required. The same admin REST API key is used for both organization group IDs.

Figure 7‑2. Example 2

In the AirWatch configuration page in the VMware Identity Manager console, configure a specific
Workspace ONE UEM organization group ID for each domain.

Figure 7‑3. Example 2 Organization Group Configuration

With this configuration, when users logs in to Workspace ONE from their device, the device registration
request attempts to locate users from Domain3 in the organization group Europe and users from
Domain4 in organization group AsiaPacific.

In example 3, one domain is mapped to multiple Workspace ONE UEM organization groups. Both
directories share the email domain. The domain points to the same Workspace ONE UEM organization
group.

VMware, Inc. 63
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Figure 7‑4. Example 3

In this configuration, when users sign in to Workspace ONE, the application prompts the users to select
which group they want to register into. In this example, users can select either Engineering or Accounting.

Figure 7‑5. Organization Groups Where Directories Share the Same Domain

Placing Devices in the Correct Organization Group

When a user record is successfully located, the device is added to the appropriate organization group.
The Workspace ONE UEM enrollment setting Group ID Assignment Mode determines the organization
group to place the device. This setting is in the System Settings > Device & Users > General > Enrollment
> Grouping page in the Workspace ONE UEM console.

Figure 7‑6. Workspace ONE UEM Group Enrollment for Devices

In example 4, all users are at the Corporate organization group level.

VMware, Inc. 64
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Figure 7‑7. Example 4

Device placement depends on the selected configuration for the Group ID Assignment Mode at the
Corporate organization group.

n If Default is selected, the device is placed in to the same group where the user is located. For
example 4, the device is placed into the Corporate group.

n If Prompt User to Select Group ID is selected, users are prompted to select which group to register
their device into. For example 4, users see a drop-down menu within the Workspace ONE app with
Engineering and Accounting as options.

n If Automatically Selected Based on User Group is selected, devices are placed into either
Engineering or Accounting based on their user group assignment and corresponding mapping in the
Workspace ONE UEM console.

Understanding the Concept of a Hidden Group

In example 4, when users are prompted to select an organization group from which to register, users also
can enter a group ID value that is not in the list presented from the Workspace ONE app. This is the
concept of a hidden group.

In example 5, in the Corporate organization group structure, North America and Beta are configured as
groups under Corporate.

Figure 7‑8. Example 5

In example 5, users enter their email address into Workspace ONE. After authentication, users are shown
a list that displays Engineering and Accounting from which to choose. Beta is not an option that is
displayed. If users know the organization group ID, they can manually enter Beta in to the group selection
text box and successfully register their device into Beta.

VMware, Inc. 65
Working in the Workspace ONE
Portal 8
When the Workspace ONE application is installed on devices, users can sign in to Workspace ONE to
securely access a catalog of applications that your organization enabled for them. When the application is
configured with single sign-on, users do not need to reenter their sign-in credentials when they launch the
app.

The Workspace ONE user interface works similarly on phones, tablets, and desktops. The Catalog page
in Workspace ONE displays resources that have been pushed to Workspace ONE. Users can tap or click
to search, add, bookmark, and update applications. They can right-click on an app to remove it from the
Bookmarked page, and go to the Catalog page to add entitled resources.

This chapter includes the following topics:

n Working with Applications in Workspace ONE

n Using the People Tab in Workspace ONE

n Setting Passcodes for the Workspace ONE Application

n Application-Level Passcodes on iOS Devices

n Adding Native Applications

n Using VMware Verify for User Authentication

n Send Alerts to Workspace ONE Users

n Working with Workspace ONE for Android Devices

Working with Applications in Workspace ONE

The Workspace ONE user portal is made up of a Catalog tap and a Bookmarks tab. When users sign in
to their Workspace ONE portal the first time, the Catalog tab is displayed if the Bookmarks tab is empty.

After the first launch, users are taken directly to the last tab visited. If users prefer to launch from the
Catalog tab, they can use the Catalog view.

You can hide either the Catalog or the Bookmarks tab in the Workspace ONE portal to provide a user
experience specific to your requirements. You can change the portal configuration from the VMware
Identity Manager console Catalog > Settings > User Portal Configuration page.

VMware, Inc. 66
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Figure 8‑1. Initial View of Bookmarks Page

From the catalog, users can install the web, mobile, and virtual applications that they are entitled to. Web
and virtual applications can be opened directly from the catalog or bookmarks page on the
Workspace ONE app.

Native applications such as iOS and Android cannot be bookmarked or launched from the
Workspace ONE pages. These apps are launched from the iOS or Android springboard.

In the catalog page, you can organize applications into logical categories to make it easier for users to
locate the resources they need. One category called Recommended is listed by default. When you
categorize applications as Recommended, you can enable Show recommended apps in Bookmarks
Tab to prepopulate the Bookmarks page with these apps.

With this configuration, users are offered immediate access to recommended applications when they first
sign in to the Workspace ONE portal.

Figure 8‑2. Workspace ONE Catalog Page

Note Mobile applications are not available from the desktop browsers.

Users can launch web applications as follows.

n From the Bookmarks tab. Users click the application icon to launch the application.

VMware, Inc. 67
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

n From the Catalog tab. Users click the box with the arrow icon to open the application.

n From Spotlight Search or Search within Workspace ONE. From the Spotlight Search on iOS devices,
users select the application icon from the list. From the Workspace ONE search, users click the box
with the arrow icon to open the application.

Users can access the Workspace ONE settings from the drop-down arrow next to their name.

n Account. The profile information for the user, including their name, user name, and email address.

n Devices. The list of devices that have signed into the Workspace ONE application and the last login
date and time.

n Application Tips. Tips about navigating Workspace ONE from the user's device.

n About. Workspace ONE copyright, patent, and license information.

n Preferences. The default launch setting when Horizon remote applications are accessed, either view
the application from the Horizon Client or from a browser.

Users tap the Workspace ONE app icon on their devices to sign in to their apps portal. If they have book
marked applications, the Bookmarks page displays. The Workspace ONE application on devices includes
links to Support and to Settings.

Figure 8‑3. Device View of Workspace ONE Portal

n The Support page includes a link to Devices and to Send Report. The Devices page shows when
they last logged in to the device. Send Report offers the user a way to send diagnostics information or
other feedback to you. Users can turn this feature off or on in their device settings.

n The Settings page shows the version of the Workspace ONE app and the VMware Workspace
privacy policy. Users can remove the account from the Settings page to log out of the
Workspace ONE application.

VMware, Inc. 68
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Using Search in Workspace ONE

Users can use search in Workspace ONE to find applications by name or by category.

As users type in the search text box, applications that match the input display.

Figure 8‑4. Search Showing Results

Users can launch a web app or download a native app directly from the search results.

On iOS devices, users can use Spotlight to search for applications that are in the Workspace ONE portal.
From the home screen on the iOS device, uses touch their finger to the screen and drag down to reveal
the Spotlight search field. When they enter an app name that is in their Workspace ONE portal,
Workspace ONE opens and the application is launched.

Helping Users Report Issues from iOS Devices

For iOS devices, the Rage Shake feature can be used to send logs to iOS app developers.

Users shake their device and the device logs its current state and sends details in an email message to
the Workspace ONE application developers by default. Users can manually enter another email address
to send the information to another address.

Users can turn on the Enable Feedback on Shake feature from the Settings > Workspace page on their
device. Users can use Rage Shake from any screen in the Workspace ONE portal to send a report.

VMware, Inc. 69
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Figure 8‑5. Enable Feedback on Shake Feature

When an iOS device receives an error message that reads similar to this device is registered to
another user or environment, the Manual App Reset option can be used to clear out all app data that
is stored locally on the device.

Using the People Tab in Workspace ONE

If you configured and enabled the People Search application in the VMware Identity Manager console, a
People tab also appears in Workspace ONE. Users can search for people in their organization and view
their profiles and organization charts from this tab.

For information about configuring and enabling People Search, see the VMware Identity Manager
Administration guide.

VMware, Inc. 70
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Users can find and contact people in their organization conveniently in the following ways.

n See their own team, including their manager and peers, when they first go to the People tab. Users
can click any of the names to view that person's profile and organization chart. Users can return to
the home page at any time by clicking the people icon.

n Use the search bar to search for people by name or email address.

n Use history for quick access to recently visited profiles. The last six user profiles visited are displayed
when the user clicks the search bar.

n View a user's profile and organization chart. The information that is displayed depends on the user
attributes that are mapped to the directory and can include the following:

n Details such as email, phone number, address, cost center, Skype for Business link, and LinkedIn
profile link

n A profile picture

n Organization hierarchy of the user

n Direct reports of the user

Organization hierarchy and direct reports are based on the managerDN attribute.

On mobile devices, the profile and organization chart appear in separate tabs.

n Contact a user directly by clicking the phone, email, or text icons next to the user's name, if available

In browsers and in Workspace ONE app versions earlier than 3.3, these links are hidden. In
Workspace ONE app 3.3, the native email and phone apps are used to perform the action.

For the behavior on the People Search app, see the VMware People Search Workspace ONE UEM
Admin Guide.

n Go to a user's Skype or LinkedIn page by clicking the link, if available

These links open in a new tab on the browser.

n Look up a user's location on a map

Maps open in a new tab on the browser.

Setting Passcodes for the Workspace ONE Application

Users must have the lock out passcode feature enabled on their devices. If it is not enabled, the first time
the Workspace ONE application is launched, users are asked to create a passcode. This passcode is
entered whenever users access Workspace ONE from their device.

If the passcode feature is not used, users are prompted to set up a passcode before they can access the
Workspace ONE application. Where the passcode is set depends on the platform. For Android devices,
the passcode is set at the app level. For Window desktop devices and for iOS devices using Workspace
ONE 3.2 or earlier, the passcode is set at the device level.

Note iOS and Android devices also support the Touch ID fingerprint sensing functionality.

VMware, Inc. 71
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Workspace ONE can detect possible security issues on devices. If users disable the passcode on the
device, the next time they access the Workspace ONE application, they are prompted to set a passcode
before they can access Workspace ONE If an app-level passcode is enabled, end users cannot disable
their app level passcode.

Application-Level Passcodes on iOS Devices

You can create more complex passcodes than the four-digit minimum device passcode. The app level
passcode can be shared with other productivity apps, for example, VMware Boxer.

You designate the local passcode requirement for an application in the Workspace ONE UEM console.
Navigate to Groups & Settings > All Settings > Apps > Settings and Policies > Security Policies >
Authentication Type.

When Passcode authentication is configured, users are prompted to set an app level passcode if no other
productivity apps exist, or they are prompted to enter their shared passcode with other productivity apps.

If Passcode authentication is not configured, a device passcode is required on iOS devices.

Adding Native Applications

Native applications are app programs that are developed for a specific mobile device. Users can see their
Workspace ONE UEM-entitled native applications from the Workspace ONE Catalog page. For example,
if a user is viewing the catalog from an iOS device, only iOS applications entitled to the user are shown.

In the Catalog page, users tap Install to install the app on their device. Upon tapping Install, a pop-up
appears to let users know what is happening next. The information displayed is based on the app type
and platform. Applications that display a lock icon require that the device be managed by Workspace
ONE UEM. When an end user attempts to download an app with a lock icon, they are prompted with a
message that reads Installation of this app requires enablement of Workspace Services.

Using VMware Verify for User Authentication

When the VMware Verify service is enabled as the second authentication method for two-factor
authentication to sign in to Workspace ONE from their device, users must download the VMware Verify
app from the device app store.

The first time users sign in to the Workspace ONE application, users are asked to enter their user name
and password. When the user name and password are verified, users are prompted to enter their device
phone number to enroll in the VMware Verify service.

When they click Enroll, the device phone number is registered with the VMware Verify service. If they
have not downloaded the VMware Verify application, they are asked to download the application.

When the application is installed, users are asked to enter the same phone number that was entered
before and to select a notification method to receive a one-time registration code. The registration code is
entered on the registration pin page.

VMware, Inc. 72
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

After the device phone number is registered, users can use a time-based one-time passcode displayed in
the VMware Verify application to sign in to Workspace ONE. The passcode is a unique number that is
generated on the device and is constantly changing.

Users can register more than one device. The VMware Verify passcode is automatically synchronized to
each of the registered devices.

Send Alerts to Workspace ONE Users

Administrators can notify Workspace ONE users for upcoming system downtime, compliance status, to
request actions, or to send alerts. Notifications are sent through the Workspace ONE UEM console.

Uses manage how they receive notifications from their devices.

Working with Workspace ONE for Android Devices

The following types of applications can be enabled through the Android Workspace ONE application.

n Web applications

n Remote applications that are enabled in the VMware Identity Manager service. For example, Horizon
virtual applications, Citrix XenApp, and ThinApp.

n Native applications, both managed and unmanaged. Native applications are Android apps developed
for Android platform. Two types are available.

n Public applications that are distributed from the Google Play Store.

n Internal applications that are privately distributed through Workspace ONE UEM and are not
available from the Google Play Store.

Web applications open in a browser. Users can access virtual applications through either VMware
Horizon Client or the Citrix Receiver.

Registering Workspace ONE App from Android Devices

Signing into the Workspace ONE app with a valid server URL and credentials allows users to access the
Workspace ONE unified catalog. In the unified catalog, users can view all the applications that are
assigned to them.

Users must register the Workspace ONE app to access the applications. In the Workspace ONE
registered state, users can use web and virtual applications that are enabled through
VMware Identity Manager, Workspace ONE UEM productivity apps, and SDK apps without management.

Note SDK apps are containerized and managed through the Workspace ONE UEM SDK and do not
require the device to be managed.

Users can initiate adaptive management, which enables Android for Work on the device and allows
profiles, policies, and improved app distribution for the device.

VMware, Inc. 73
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Managing Android for Work with Workspace ONE

Enabling Android for Work on devices separates personal data from the work data at the operating
system level. Android for Work creates a clear separation between work and personal apps. Android for
Work creates the work applications with a distinct Android work badge.

Figure 8‑6. Android for Work Content

The admins determine which applications in the catalog require a device to be managed before the app
can be accessed. Applications in the catalog that require management display a distinct star symbol next
to the download button.

When users try to download one of these applications, they receive a message that the application
requires the device to be managed. A screen displays that describes the features and benefits of device
management.

Figure 8‑7. Workspace Services Introduction Page

VMware, Inc. 74
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

When users agree to enable Android for Work management, users are guided through the process to set
up management. After the device is managed, the Android for Work container is created on the device.

VMware, Inc. 75
Using the Workspace ONE
Catalog 9
When Workspace ONE UEM and VMware Identity Manager are integrated, the Workspace ONE app
catalog is the repository of all the resources that you can entitle to users. Users can access enterprise
applications that you manage in the Workspace ONE catalog based on the settings you establish for the
application.

Cloud, Mobile, and Windows applications can be accessed from the catalog. Native applications that are
internally developed or publicly available in app stores can be made available to your end users from the
Workspace ONE portal.

In the Workspace ONE Catalog pages, you can perform the following tasks

n Add new resources to your catalog

n View the resources to which you can currently entitle users

n Access information about each resource in your catalog

Some web application can be added to your catalog directly from the Catalog pages. Other resource
types require you to take action outside the administration console. See the VMware Identity Manager
Setting Up Resources guide for information about setting up resources.

Managing Resources in the Catalog

Before you can entitle a particular resource to your users, you must populate your catalog with that
resource. The method you use to populate your catalog with a resource depends on what type of
resource it is.

The types of resources that you can define in your catalog for entitlement and distribution to users are
Web applications, Windows applications captured as VMware ThinApp packages, Horizon Client desktop
pools and Horizon virtual applications, or Citrix-based applications.

To integrate and enable Horizon Client desktop and application pools, Citrix-published resources, or
ThinApp packaged applications, you use the Virtual Apps Collection feature available in the Catalog tab
drop-down menu.

For information, requirements, installation, and configuration of these resources, see Setting Up
Resources in VMware Identity Manager.

VMware, Inc. 76
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Adding Web Applications to Your Organization's Catalog

You can add Web applications to your catalog by either selecting them from the cloud application catalog
or creating new ones.

The cloud application catalog contains commonly used enterprise Web applications. These applications
are partially configured and you must provide additional information to complete the application record.
You might also need to work with your Web application account representatives to complete other
required setup.

Many of the applications in the cloud application catalog use SAML 2.0 or 1.1 to exchange authentication
and authorization data to enable single sign-on from Workspace ONE to the Web application.

When you create an application, you need to enter all the configuration information for the application.
The configuration varies based on the type of application you are adding. For applications with no
federation protocol, you only require a Target URL.

Applications from any third-party identity providers that you have configured as application sources in
VMware Identity Manager are added as new applications.

While adding an application, you also select an access policy to control user access to the application. A
default access policy is available and you can also create new policies from the Identity & Access
Management > Manage > Policies page. See VMware Identity Manager Administration for information
about access policies.

Grouping Resources into Categories

You can organize resources into logical categories to make it easier for users to locate the resource they
need in their Workspace ONE portal.

When you create categories consider the structure of your organization, the job function of the resources,
and type of resource. You can assign more than one category to a resource. For example, you might
create a category called Sales Associate and another category called Staff Sales Resources. Assign
Sales Associate to all the sales resources in your catalog. Also assign Staff Sales Resources to specific
sales resources that are shared with only the staff associates.

After you create a category, you can apply that category to any of the resources in the catalog. You can
apply multiple categories to the same resource.

When users sign in to their Workspace ONE portal, they see the categories that you enabled for their
view.

See the VMware Identity Manager Administration guide, Managing the Catalog.

VMware, Inc. 77
Custom Branding for
VMware Identity Manager
Services 10
You can customize the logos, fonts, and background that appear in the VMware Identity Manager
console, the user and administrator sign-in screens, the Web view of the Workspace ONE applications
portal, and the Web view of the Workspace ONE application on mobile devices.

You can use the customization tool to match the look and feel of your company's colors, logos, and
design.

This chapter includes the following topics:

n Customize Branding in VMware Identity Manager Service

n Customize Branding for the User Portal

Customize Branding in VMware Identity Manager Service

You can add your company name, product name, and favicon to the address bar for the administration
console and the user portal. You can also customize the sign-in page to set background colors to match
your company's colors and logo design.

Procedure

1 In the VMware Identity Manager console Identity & Access Management tab, select Setup > Custom
Branding.

2 Edit the following settings in the form as appropriate.

Form Field Description

Names and Logos Tab

Company Name Company Name applies to both desktops and mobile devices. You can add your company's
name as the title that appears in the browser tab.
Enter a new company name over the existing one to change the name.

Product Name Product Name applies to both desktops and mobile devices. The product name displays after the
company name in the browser tab.

Favicon A favicon is an icon associated with a URL that is displayed in the browser address bar.
The maximum size of the favicon image is 16 x 16 px. The format can be JPEG, PNG, GIF, or
ICO.
Click Upload to upload a new image to replace the current favicon. You are prompted to confirm
the change. The change occurs immediately.

VMware, Inc. 78
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Form Field Description

Sign-In Screen Tab

Logo Click Upload to upload a new logo to replace the current logo on the sign-in screens. When you
click Confirm, the change occurs immediately.
The minimum image size recommended to upload is 350 x 100 px . If you upload images that are
larger than 350 x 100 px, the image is scaled to fit 350 x 100-px size. The format can be JPEG,
PNG, or GIF.

Background Color The color that displays for the background of the sign-in screen.
Enter the six-digit hexadecimal color code over the existing one to change the background color.

Box Background Color The sign-in screen box color can be customized.
Enter the six-digit hexadecimal color code over the existing code.

Login Button The color of the login button can be customized.

Background Color Enter the six-digit hexadecimal color code over the existing one.

Login Button Text Color The color of the text that displays on the login button can be customized.
Enter the six-digit hexadecimal color code over the existing one.

When you customize the sign-in screen, you can see your changes in the Preview pane before you
save your changes.

3 Click Save.

Custom branding updates to the VMware Identity Manager console and the sign-in pages are applied
within five minutes after you click Save.

What to do next

Check the appearance of the branding changes in the various interfaces.

Update the appearance of the end-user Workspace ONE portal and mobile and tablet view. See
Customize Branding for the User Portal

Customize Branding for the User Portal

You can add a logo, change the background colors, and add images to customize the Workspace ONE
portal.

Procedure

1 In the VMware Identity Manager console Catalogs tab, select Settings > User Portal Branding.

2 Edit the settings in the form as appropriate.

Form Item Description

Logo Add a masthead logo to be the banner at the top of the VMware Identity Manager console and
Workspace ONE portal Web pages.
The maximum size of the image is 220 x 40 px. The format can be JPEG, PNG or GIF.

Portal

VMware, Inc. 79
Guide to Deploying VMware Workspace ONE with VMware Identity Manager

Form Item Description

Masthead Background Enter a six-digit hexadecimal color code over the existing one to change the background color of
Color the masthead. The background color changes in the application portal preview screen when you
type in a new color code.

Masthead Text Color Enter a six-digit hexadecimal color code over the existing one to change the color of the text that
displays in the masthead.

Background Color The color that displays for the background of the Web portal screen.
Enter a new six-digit hexadecimal color code over the existing one to change the background
color. The background color changes in the application portal preview screen when you type in a
new color code.
Select Background Highlight to accent the background color. If Background Highlight is
enabled, browsers that support multiple background images show the overlay in the launcher
and catalog pages.
Select Background Pattern to set the predesigned triangle pattern in the background color.

Icon Background Color Enter a six-digit hexadecimal color code to change the background color box surrounding
application icons.

Icon Background To set a transparency, move the slider on the bar.

Opacity

Name and Icon Color You can select the text color for names listed under the icons on the app portal pages.
Enter a hexadecimal color code over the existing one to change the font color.

Lettering effect Select the type of lettering to use for the text on the Workspace ONE portal screens.

Background Highlight If enabled, for browsers that support multiple background images, the background overlay
displays in the bookmark and catalog pages.

Background Pattern If enabled, for browsers that support multiple bg images, the background overlays display in the
bookmark and catalog pages.

Image (Optional) To add an image to the background on the app portal screen instead of a color, upload an image.

3 Click Save.

Custom branding updates are refreshed every 24 hours for the user portal. To push the changes sooner,
as the administrator, open a new tab and enter this URL, substituting your domain name for
myco.example.com. https://<myco.example.com>/catalog-portal/services/api/branding?
refreshCache=true.

What to do next

Review the appearance of the branding changes in the various interfaces.

VMware, Inc. 80
Accessing Other Documents 11
When setting up Workspace ONE, you might need to reference documentation for both
VMware Identity Manager and VMware Workspace ONE UEM.

Additional documentation can be found at these documentation centers

n VMware Workspace ONE

n VMware Workspace ONE UEM

n VMware Identity Manager

VMware, Inc. 81