Configuring Basic macOS Management: Workspace ONE Operational Tutorial
VMware Workspace ONE UEM 9.4 and laterOverview
Introduction
VMware provides this operational tutorial to help you with your VMware Workspace ONE® environment. In this tutorial, you enroll a macOS device, configure a restrictions profile and a dock profile, configure a device lock, and deploy macOS volume-purchased apps.
Audience
This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments.
Both current and new administrators can benefit from using this tutorial. Familiarity with macOS, XML, and basic scripting is assumed.
Knowledge of additional technologies such as VMware Workspace ONE® Intelligence and VMware Workspace ONE® UEM is also helpful.
Enrolling macOS Devices
Introduction
This section covers basic macOS administration using Workspace ONE UEM. This exercise helps you to install the Workspace ONE Intelligent Hub and enroll a macOS device into Workspace ONE UEM.
Prerequisites
Before you can perform the exercises in this tutorial, you must meet the following requirements.
- Workspace ONE UEM version 9.4 or later
- Apple device running macOS version 10.12.6 (Sierra) or later
- Retrieving the Group ID from Workspace ONE UEM Console
- Local macOS account with administrator permissions
This exercise requires admin and end user device authentication during enrollment. Gather the required account information, and record it in the following table. The account information provided in the table is based on a test environment. Your account details will differ.
Local Administrator Account Information | ||
User name | administrator |
|
Password | VMware1! |
|
User Account Information | ||
User name | testuser |
|
Password | VMware1! |
|
testuser@company.com |
||
Workspace ONE UEM Information | ||
Server URL | hol.awmdm.com |
Logging In to the Workspace ONE UEM Console
To deploy a 3rd party macOS app, you must first log in to the Workspace ONE UEM Console.
1. Launch Chrome Browser

On your desktop, double-click the Google Chrome icon.
3. Authenticate In to the Workspace ONE UEM Console

- Enter your Username, for example,
administrator
. - Click Next. After you click Next, the Password text box is displayed.

- Enter your Password, for example,
VMware1!
- Click Login.
Note: If you see a Captcha, be aware that it is case sensitive.
Installing the Workspace ONE Intelligent Hub
In this exercise, download and install the Workspace ONE Intelligent Hub on your macOS device.
1. Log In to the MacBook - If Needed

Log in to the macOS device with your administrator credentials.
- Enter the username. For example,
administrator
. - Enter the password. For example,
VMware1!
. - Click the arrow icon or press
ENTER
.
2. Open the Browser

Click the Safari icon (blue compass) to open the Safari browser.
3. Download the Agent

- Enter
https://getwsone.com
in the URL field, then pressENTER
. - Click Download Hub for macOS. The Workspace ONE Intelligent Hub begins to download and will save to the
Downloads
folder by default.
4. Launch the Installer

- Click the Downloads folder in the dock (next to the Trash Bin).
- Click the VMwareWorkspaceONEIntelligentHub.pkg file to begin the installer.
5. Review the Introduction

Click Continue.
6. Review and Accept Licensing Terms

- In the Installer, click Continue.
- Click Agree (to the license terms).
7. Select Destination for the Installer

Click Continue.
8. Define Install Location and Provide Administrator Credentials

- Click Install to perform a standard installation.
- Enter the admin user name, for example,
Administrator
. - Enter the password.
- Click Install Software.
9. Complete Installation

- Click Close when the installer finishes.
- Click Move to Trash to move the installer to the trash.
Onboarding using User-Initiated Agent-Based Workflow
In this exercise, you enroll a macOS device into Workspace ONE UEM. Enrollment is the action that brings a device under management and control by Workspace ONE UEM. There are a number of ways to enroll the various platforms (macOS included), but for this exercise, we cover a basic enrollment scenario.
This enrollment flow is considered User-Approved per the functionality introduced in macOS High Sierra.
1. Initiate Enrollment

After the Workspace ONE Intelligent Hub finishes installing, the Enrollment Wizard should start automatically. From within the Enrollment wizard window, click Server Detail.
Note: The Enrollment Wizard may take several minutes to launch. If you do not see the Enrollment Wizard immediately, be patient and wait for it to appear.
2. Enter Enrollment Server Details

- Enter your Workspace ONE UEM URL, for example,
hol.awmdm.com
. - Enter your Group ID. See Retrieving the Group ID from Workspace ONE UEM Console.
- Click Continue.
3. Enter Enrollment Credentials

- Enter the enrollment username. For example,
testuser
. - Enter the enrollment user password. For example,
VMware1!
. - Click Continue.
4. Enable Device Management

Click Enable to enable device management.
5. Install Workspace Services

Click Install.
6. Install the User-Approved Enrollment Profile

Click Install.
7. Enter Credentials

- When prompted, enter the password for your user account on the Mac. For example,
VMware1!
. - Click OK.
8. Quit the Profiles Panel

Click the red dot to close the Profiles panel.
9. Quit the Enrollment Wizard

Click Quit.
10. Validate Enrollment

To verify that your MacBook enrolled successfully:
- In the upper-right corner of your screen, click the Hub icon.
- In the menu that appears, note your device's Enrolled status.
- Click Preferences and review the available options.
Configuring macOS Profiles
Introduction
Profiles are the mechanism by which Workspace ONE UEM manages settings on a macOS device. All profiles are broken down into two basic sections; the General section and the Payload section.
- The General section defines the profile's name and assignment settings.
- The Payload sections define actions to be taken on the device.
Every profile must have all required fields in the General section properly filled out and at least one payload configured.
With Workspace ONE UEM, profile management for macOS can occur on the device level or on the user level.
Device-level profiles apply restrictions and settings to any user logged-on to the device. Device profiles are typically used to control settings that apply system-wide such as VPN and Wi-Fi configurations, Global HTTP Proxy, Disk Encryption, and/or Directory (LDAP) integration.
In contrast, user-level profiles apply settings and restrictions to the specific user logged-on to the device. User profiles typically control settings that apply to the enrolled user such as email configurations, web clips (URL shortcuts), credentials (certificates), and content filtering settings.
Prerequisites
Before you can perform the exercises in this tutorial, you must meet the following requirements.
- Workspace ONE UEM version 9.4 or later
- Apple device running macOS version 10.12.6 (Sierra) or later
Configuring a Restrictions Profile for macOS Devices
In this exercise, deactivate Bluetooth and Energy Saver settings on a macOS device by configuring a device-level Restrictions profile. This exercise explores how to modify the macOS device behavior using Profiles.
1. Close System Preferences if opened

This section helps you to create a device profile which will change some system preferences in your Mac. However, to see those changes take place, you must first close any existing System Preference sessions if they are already open.
If System Preferences are opened, click X to close.
2. Navigate to Profile Settings

In the Workspace ONE UEM console:
- Select Devices.
- Select Profiles & Resources.
- Select Profiles.
- Select Add.
- Select Add Profile.
3. Select Profile Platform

Select macOS.
4. Select the Profile Context

Select Device Profile.
5. Configure General Settings

Configure the device profile as follows:
- Select General if it is not already selected.
- Enter
macOS Device Restrictions
for the profile name. - Select
Auto
for the Assignment Type. - Scroll down to view Assigned Groups, and click in the search box. From the list of Assignment Groups that appear, select the appropriate group. For example, select
All Devices (your@email.shown.here)
.Note: You do not need to click Save or Save & Publish at this point. This interface allows you to move around to different payload configuration screens before saving.
6. Select the Restrictions Payload

- Select Restrictions.
- Click Configure.
Note: When initially setting most payloads, a Configure button will show to reduce the risk of accidentally setting a payload configuration.
7. Configure the Restrictions Payload

- Select Restrict System Preference Panes.
- Select Disable Selected Items.
- Select Bluetooth.
- Select Energy Saver.
8. Save and Publish

Click Save and Publish.
10. Verify the Device Profile Exists

You should now see your macOS Device Restrictions Device Profile within the list of the Profiles window.
Note: If you need to edit the profile, this is where you would do so.
11. Validate Profiles

- Click the Apple icon in the upper-left corner.
- Click System Preferences.
- If System Preferences shows you a specific subpanel, such as Time Machine, click the back button.
- Note you cannot modify the settings for Bluetooth and Energy Saver as those icons are grayed-out.
Configuring a Dock Profile for macOS Users
In this exercise, change the dock settings for a specific, enrolled user on a macOS device by configuring a user-level profile.
1. Navigate to Profile Settings

- Select Add.
- Select Add Profile.
2. Select Profile Platform

Select macOS.
3. Select the Profile Context

Select User Profile.
4. Configure General Settings

- Select General.
- Enter
macOS User Dock
in the Name text box. - Ensure the Assignment Type is set to Auto.
- Click in the Assigned Groups field. From the list of Assignment Groups that appear, select the appropriate group. For example, select
All Devices (your@email.shown.here)
.
Note: You do not need to click Save or Save & Publish at this point. This interface allows you to move around to different payload configuration screens before saving.
5. Select the Dock Payload

- Select Dock.
- Click Configure.
6. Configure the Dock Payload

- Change the Dock Size to be smaller.
- Change the Dock Position to Left.
7. Save & Publish

Click Save & Publish.
8. Publish the User Profile

Select Publish.
9. Verify the User Profile
You should now see your macOS User Dock user profile in the Profiles window.
Note: If you need to edit the profile, this is where you would do so.
10. Validate Profile

Validate that the Dock has changed size and moved to the left side of the screen.
Configuring Device Lock for macOS
Introduction
Device lock for macOS devices causes the machine to reboot into a firmware-lock screen. This lock screen occurs at the firmware level prior to OS boot. This exercise helps you to configure a macOS device lock.
Prerequisites
Before you can perform the exercises in this tutorial, you must meet the following requirements.
- Workspace ONE UEM version 9.4 or later
- Apple device running macOS version 10.12.6 (Sierra) or later
Configuring Device Lock
Workspace ONE UEM supports a firmware-based device lock for macOS. The device cannot be booted until the device lock code has been entered. This exercise helps you to configure device lock for macOS.
1. Open macOS Device Details

- Select Devices.
- Select List View.
2. Select macOS Device

Select your enrolled macOS device.
Note: In this exercise we are using MacBooks—ensure that you are selecting your enrolled macOS device.
4. Enter Device Lock Code

- Enter
111111
as the firmware lock code. - Click Lock Device.
5. Device Reboot

The device reboots after a short delay and the firmware will be locked.
6. Unlock The Device

- At the System Lock screen, enter the unlock code
111111
. - Click the Arrow (-->) to boot the device.
Understanding macOS Software Delivery
Introduction
Workspace ONE UEM supports a few different methods for delivering software to managed macOS devices. This section helps you to volume-purchase app licenses in Apple Business Manager, then assign them to enrolled devices in Workspace ONE UEM.
The following software delivery methods are available for macOS:
- Apple Business Manager or Apple School Manager — Delivers macOS App Store applications to devices as volume-licensed, purchased applications.
- Software Distribution — Delivers third-party, non-store applications as internal apps in Workspace ONE UEM 9.3 and later.
- Product Provisioning — Deploys non-store applications and scripts as products in AirWatch 9.2 and earlier.
The type of software being delivered determines appropriate delivery method. The following table lists different types of software, and their recommended delivery method.
Store Apps | Non-Store Apps | |
---|---|---|
Delivery Method | Apple Business Manager | Software Distribution |
Examples |
|
|
Prerequisites
Before you can perform the exercises in this tutorial, you must meet the following requirements.
- Workspace ONE UEM version 9.4 or later
- Apple device running macOS version 10.12.6 (Sierra) or later
Deploying macOS Volume-Purchased Apps
In this section, watch a video that shows how to purchase app licenses in Apple Business Manager, then assign them to enrolled devices in Workspace ONE UEM.
This section shows how to volume-purchase applications through the app store and assign to devices using device-based licensing. However, Workspace ONE UEM also supports non-store, third-party software management. For details, see Deploying Third-Party macOS Applications: VMware Workspace ONE Operational Tutorial on VMware Tech Zone.
Summary and Additional Resources
Conclusion
This operational tutorial provided basic administration steps to manage macOS with Workspace ONE UEM. Procedures included enrolling a macOS device, configuring a restrictions profile and a dock profile, configuring a device lock, and deploying macOS volume-purchased apps.
Additional Resources
For more information about Workspace ONE, explore the VMware Workspace ONE Activity Path. The activity path provides step-by-step guidance to help you level-up in your Workspace ONE knowledge. You will find everything from beginner to advanced curated assets in the form of articles, videos, and labs.
Additionally, you can check out the VMware Workspace ONE and VMware Horizon Reference Architecture which provides a framework and guidance for architecting an integrated digital workspace using VMware Workspace ONE and VMware Horizon.
For more information on macOS, see Understanding macOS Management.
About the Author
This tutorial was written by:
- Robert Terakedis, Senior Technical Marketing Manager, End-User-Computing Technical Marketing, VMware
Feedback
Your feedback is valuable.
To comment on this tutorial, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.