Digital Signage: Workspace ONE Operational Tutorial

Overview

Introduction

Apple TV has long been a great solution for conference rooms by delivering an intuitive, wireless solution to eliminate costly adapters required for screen sharing. Increasingly, we're seeing Apple TV adoption in hotel room and lobby displays, digital signage, and more! With Workspace ONE, IT administrators can deploy and configure Apple TV in much the same way as other Apple devices. Using Apple Business Manager (or Apple School Manager), you can simply plug in the Apple TV (power and Ethernet), and Workspace ONE handles the entire configuration hands-free!  

This tutorial aims to provide instructions on how to configure typical signage use-cases for Apple TV. If you'd like to see something specific added to this tutorial, let us know in the feedback below!

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. Both current and new administrators can benefit from using this tutorial. Familiarity with Apple technologies is assumed, including Apple Business Manager, tvOS, and Mobile Device Management.

Prerequisites

Workspace ONE UEM has supported Apple TV enrollment and management for years. However, as Apple TV has gained new features and capabilities, we recommend managing Apple TV with current versions of Workspace ONE to help enable the best management experience available. As such, the following prerequisites apply to Apple TV configuration and management as it pertains to this Operational Tutorial:

  • Workspace ONE UEM 2105
  • Apple Business Manager or Apple School Manager
    • Automated Enrollment Profile configured and assigned to Apple TV devices
    • Use-case-specific applications assigned to a Location Token synced with Workspace ONE UEM

Deployment Considerations

This tutorial specifically covers how to automatically enroll tvOS under management. With auto-enrollment, there is no prompt for authentication credentials before a device is enrolled to management (and potentially receives corporate-managed configurations). As such, there exists a minor risk of inadvertently enrolling non-tvOS devices without authentication if the configurations for auto-enrolled tvOS exists in the same Organization Group as other Apple Business Manager (or Apple School Manager) devices.  

VMware recommends Workspace ONE UEM administrators leverage the multi-tenancy capabilities of Workspace ONE UEM and multi-MDM capabilities of Apple Business Manager to create an Organization Group dedicated to auto-enrolled tvOS device management. Within that dedicated Organization Group, administrators can tie a new MDM Server Token (device management) and Location Token (app management) from Apple Business Manager (or Apple School Manager).

See Create Organization Groups for more information on how to create new Organization groups.

Integrating Apple Business Manager for tvOS Apps

Overview

Workspace ONE administrators can streamline Apple TV Application deployment by leveraging Apple Business Manager. Using Apple Business Manager, Workspace ONE administrators can bulk license applications (Public or Custom) from the App Store and distribute them to enrolled Apple TVs.  Additionally, Workspace ONE assigns the licenses directly to the device (and including managed configurations), eliminating the need to configure and support an Apple ID on Apple TV.

Adding Location Token to Workspace ONE UEM

An Apple Business Manager (or Apple School Manager) location is a container that ties a set of books and apps to one or more content managers. Each location has a token that can be uploaded to Workspace ONE to allow App and Book management within the Workspace ONE UEM organization group. The token provides the credentials by which Workspace ONE authenticates to Apple Business Manager to sync assets and manage license assignment.

1. Download Token from Apple Business Manager

App and Books in Apple Business Manager

Within Apple Business Manager (or Apple School Manager):

  1. Click Settings.
  2. Click Apps and Books.
  3. Click Download for the Server Token next to your Location.
  4. For macOS Catalina and later, click Allow to allow the download from Apple Business Manager.

2. Select VPP Managed Distribution

In Workspace ONE UEM:

  1. Click Groups & Settings.
  2. Click Configurations.
  3. Scroll down through the list of Configurations.
  4. Select VPP Managed Distribution.

3. Upload Location Token

  1. Ensure the Current Setting is set to Override.
  2. Enter a friendly name for the Location.
  3. Click Upload.
  4. In the dialog box, click Choose File. Browse to and select the vpptoken file downloaded in Download Token from Apple Business Manager, and select Choose.
  5. Click Save.
  6. Click Save.

4. Cancel Warning About License Usage in Other Environments

If you unexpectedly receive a message about the sToken being used in another environment, click Cancel. An Apple Business Manager (or Apple School Manager) location can be managed by only one (1) MDM or UEM system at a time. You should resolve the reason for this message before attempting to upload the Token. Alternatively, create a new location in Apple Business Manager.

Note: Instead of uploading the same Token in both your Testing and Production Workspace ONE UEM instance, you should create a second location in Apple Business Manager. Within Apple Business Manager, you can allocate unused licenses between locations allowing you to purchase additional licenses (or move a subset) into your second Location for testing.

For questions regarding Apple Business Manager, refer to Apple Support.

Syncing Volume Purchase Licenses

By default, Workspace ONE syncs managed distribution licenses for custom apps and volume-licensed public apps daily. The sync is scheduled automatically, allowing Workspace ONE to reconcile newly purchased licenses and updated metadata (descriptions and images). When you upload a location token, you can speed up this process by manually initiating a license sync.

Sync Licenses from Apple Business Manager

Custom Apps in Workspace ONE UEM

In the Workspace ONE console:

  1. Click Resources.
  2. Expand Apps and click Native.
  3. Click Purchased.
  4. Click Sync Assets.
  5. Click Refresh  to view assets that have been updated from the sync.

Tip: For license and metadata sync to work for on-premises Workspace ONE customers, admins must allow access to *.itunes.apple.com over TCP port 80 and 443. Refer to Use Apple Products on Enterprise Networks for the full list of hosts and ports required to manage and use Apple products on enterprise networks.

Bulk-Enabling Device-Based Licensing

Managed distribution licenses can be assigned on a per-user, or per-device basis. For the per-user licensing model, the end-user of the device is prompted to enter their Apple ID credentials into the device to assign the license. In other words, per-user license distribution requires that all users have an Apple ID. In the per-device licensing model, managed distribution licenses are assigned directly to the device regardless of whether the user has entered Apple ID information. The end-user is not required to have an Apple ID in order for the app to be assigned to the device and installed from the App Store.

For more information, refer to Managed Distribution by Device Serial Number.

Note: If a device is supervised, the user does not get prompted to participate in volume-purchased app management.

Warning: If you convert an application to device-based licensing, you cannot revert it back to user-based licensing.

Bulk-Enable Device-Based Licensing


Custom Apps in Workspace ONE UEM

In the Workspace ONE UEM Console:

  1. Click Resources.
  2. Expand Apps and click Native.
  3. Select Purchased.
  4. Select one or more Public and/or Custom Apps.
  5. Click Enable Device Assignment.
  6. Click OK to enable device-based licensing for the selected apps.

Integrating Apple Business Manager for tvOS Enrollment

Overview

In some automated enrollment scenarios, Apple Business Manager allows you to bypass user authentication and enroll the device directly to management. Workspace ONE considers enrollment without authentication a form of device staging. To enable automated device enrollment with Apple Business Manager, Workspace ONE administrators configure a specialized staging user account.  

In some scenarios, Workspace ONE administrators can pre-assign devices to a specific end-user's account or change the assignment post-enrollment. However, in the case of automated enrollment and Apple TV's, there's no necessary reason to re-assign the device to a specific user account. Apple TV management occurs at a device-level, meaning there is no need to assign the device to a non-staging user.

For more detail about staging, see Enrollment Considerations, Device Staging.

Create tvOS Enrollment User Account

1. Browse to User List

  1. Click Accounts.
  2. Expand Users and click List View.
  3. Click Add.
  4. Click Add User.

2. Configure User General Tab

  1. Click the General tab.
  2. Click Basic.
  3. Enter a User Name (such as AppleTVs).
  4. Enter and confirm a new Password.
  5. Enter a First and Last name.
  6. Enter a valid email address for the enrollment user.
  7. Click Save.

NOTE: Since the Apple TVs will be enrolling without user intervention, it is recommended to use a strong password for the enrollment user account.

Integrating Apple Business Manager for Automated Enrollment

Automated device enrollment is a function of the enrollment (previously DEP) profile assigned to the device. A full walk-through of how to perform the token exchange between Apple Business Manager and Workspace ONE is available on YouTube.  

NOTE: If Apple Business Manager is already integrated into your Workspace ONE environment, you can skip the following video walk-through.

Integrating Apple Business Manager and Workspace ONE UEM

For the purposes of tvOS management, refer to Configure DEP Profile for Zero-Touch tvOS Enrollment for instructions on how to configure a NEW automated enrollment profile specifically for your Apple TVs.

Configure Automated Device Enrollment Profile for tvOS

To enable an Apple device for zero touch enrollment, you must configure an automated device enrollment profile.  This section illustrates how to configure this profile for an Apple TV.

1. Browse to Configurations

  1. Click Groups & Settings.
  2. Click Configurations.
  3. Click Apple Device Enrollment Program.

2. Add New Profile



Click Add Profile.

3. Configure Profile Settings



  1. Set Custom Enrollment to OFF.
  2. Set Authentication to OFF.
  3. Select None.
  4. Choose the User you created in Create tvOS Enrollment User Account.
  5. Set the appropriate Device Ownership Type.
  6. Scroll down to the remaining profile items.

4. Configure More Profile Settings



  1. Enter a name for DEP profile.
  2. Enter the Department .
  3. Enter the Support Number.
  4. Click ENABLED for Require MDM Enrollment.
  5. Click ENABLED for Supervision.
  6. Click ENABLED for Lock MDM Profile.
  7. Click ENABLED for Await Configuration.
  8. Click ENABLED for Auto Advance Setup.
  9. Scroll down to additional profile settings.

5. Skip Setup Assistant Screens

  1. Choose SKIP for all the Setup Assistant screens (Passcode through Primary Account Setup).
  2. Scroll to view remaining setup assistant screen items.

6. Finish and Save Profile



  1. Accept the defaults for Admin Account Creation.
    NOTE: This section is not applicable to tvOS.
  2. Click SAVE.

7. View Created Profile and Lifecycle Page



  1. Note the Default Profile is not changed. Newly synced devices continue to get assigned to the default profile previously configured.
  2. Note the newly created auto-enroll profile.
  3. Note that by default, no devices are initially assigned to the new profile. You must manually assign this DEP profile to devices.
  4. Click VIEW ENROLLMENT STATUS PAGE to start assigning the profile to Apple TVs.

Assign Auto Enrollment Profile to Devices

The DEP Profile which auto-enrolls devices to the Apple TV enrollment user is inactive until assigned to devices synced from Apple Business Manager. This section illustrates how to assign the profile to a device.

1. OPTIONAL: Sync New Devices

Lifecycle > Enrollment Status

If you suspect devices have been added to the MDM Server Token in Apple Business Manager, you can sync those devices to Workspace ONE UEM by following these steps:

  1. Click Devices.
  2. Expand Lifecycle and click Enrollment Status.
  3. Click Sync Devices and click Apple.
  4. In the pop-up, click Sync.

2. Select Device to Assign Profile



  1. Refresh the list of devices (if you've recently triggered a sync).
  2. Select one or more Apple TVs.
  3. Click More Actions.
  4. Click Assign Profile.

3. Choose Profile

  1. Select your Auto-Enrollment profile for Apple TV(s).
  2. Click Save.

Configuring Apple TV Payloads

Creating tvOS Assignment Groups

Prior to assigning profiles and apps, Workspace ONE UEM administrators should create the assignment groups which will be used to group their Apple TVs. The following instructions provide a basic guide to create a group of Apple TVs.   

NOTE: Your specific requirements may be different and require multiple assignment groups (for example, assigning to specific enrollment user accounts, or manually selecting Apple TVs).

1. Browse to Assignment Groups

  1. Click Groups & Settings.
  2. Expand Groups.
  3. Click Assignment Groups.
  4. Click Add Smart Group.

2. Configure Smart Group

  1. Enter a name for the Smart Group.
  2. Choose Apple tvOS as the platform, and optionally a specific constraint and OS version.
  3. If desired, click Enabled to preview the list of devices that are members of the group.
  4. Optionally, you can select Devices Or Users to select individual Apple TVs or Enrollment Users to add to the Smart Group.
  5. Click Save.

NOTE: If you plan to enroll all your digital signage devices as a dedicated user account, it may be easier to configure the smart group by selecting the specific user(s).

Configure Single App Mode Settings

If using Apple TVs as a digital sign, leverage a Single App Mode profile to lock the Apple TV into the digital signage app. This prevents the Apple TV from going to sleep, and ensures that if the Apple TV is restarted (such as due to a power loss), the digital signage app is re-launched and continues displaying as intended.

1. Add Profile

  1. Click Resources.
  2. Expand Profiles & Baselines and click Profiles.
  3. Click Add > Add Profile.

2. Choose Platform

Profiles & Baselines > Profiles

Click tvOS.

3. Configure Profile



  1. When the profile screen loads, enter a Name and Description for the Single App Mode profile.
  2. Search for single.
  3. Click Add to add the Single App Mode payload to the profile.
  4. Enter the specific Application Bundle ID (examples shown below) to start the digital signage software.
  5. Enable the slider for Disable Auto-Lock.
  6. Click Next.
Digital Signage Application Application Bundle ID
Kitcast tv.kitcast.app.player
Carousel Cloud Player com.trms.CarouselCloudPlayer
Exhibit (previously “MDM Image Viewer”) edu.nebraska.ImageViewer

NOTE: You can locate the Application Bundle ID for any tvOS volume-purchased application in the Workspace ONE UEM console by looking at the application details:


Apps > Native

4. Configure Assignment



  1. Select one or more Smart Groups.
  2. Select Managed.
  3. Select Auto.
  4. Click SAVE & PUBLISH.

Deploying Kitcast for Digital Signage

Overview

If you use screens to communicate with your target audience, Kitcast can help. Kitcast allows you to create, schedule, and manage content across all your connected screens.  With Workspace ONE, administrators can easily onboard new Apple TVs as a Kitcast screen by leveraging the zero touch onboarding provided by Apple Business Manager. Administrators manage the content on their Kitcast screen (for example, Apple TV onboarded by Workspace ONE), using an intuitive editor that leverages templates and widgets.  

Prerequisites

Obtain Your Secret Key

Prior to deploying Kitcast to Apple TV, you must contact Kitcast support to obtain your Secret Key. Support will send you a plist similar to the following:

<plist>
<dict>
    <key>secret</key>
    <string>ABCD1234/ABCD1234/ABCD1234</string>
    <key>id</key>
    <string>$UDID</string>
    <key>name</key>
    <string>$DEVICENAME</string>
    <key>locationID</key>
    <string>$SITEID</string>
    <key>location</key>
    <string>$SITENAME</string>
</dict>
</plist>

About Kitcast locationID and location Keys

The locationID and location keys used in the application configuration sent to the Kitcast app correspond to the unique location you've created in the Kitcast dashboard. The locationID is a numeric identifier and the location key is the location's display name in Kitcast.

  • If you enter an arbitrary locationID and location (such as a location name), when the Kitcast app loads on the Apple TV you will see a new location created in Kitcast. You can then edit the new location to include the required content for that specific set of Apple TVs.
  • If you have already created the location in Kitcast, contact Kitcast support to obtain the specific locationID and location values for that specific location.

 

Deploying Kitcast App to tvOS

1. Select Kitcast App to Deploy

  1. Click Resources.
  2. Expand Apps and click Native.
  3. Click Purchased.
  4. Select the Kitcast app for tvOS.
  5. If not already done (see Bulk-Enabling Device-Based Licensing), click More Actions > Enable Device Assignment, and click OK.
  6. Click Assign.

2. Assign and Allocate App

  1. Enter a name for your app assignment.
  2. Select the Smart Group that contains the tvOS devices.
  3. Enter the number of volume-purchased licenses to allocate to this assignment.
  4. Choose Auto as the deployment method.

NOTE:  More information on creating Smart Groups for tvOS can be found in Creating tvOS Assignment Groups.

3. Configure App Restrictions

Workspace ONE UEM Console
  1. Click Restrictions.
  2. Enable Remove on Unenroll.
  3. Enable Prevent Removal.

4. Enable App Configuration

  1. Click Application Configuration.
  2. Enable Send Configuration.
  3. Click Add.
  4. Enter the key name, value type, and value as noted below.
  5. Add additional key/value pairs by clicking Add and entering additional Application Configuration information.
  6. Click Create.
Configuration Key Value Type Configuration Value
secret string The secret supplied in the XML supplied by Kitcast:

<key>secret</key>
<string>abcd1234/abcDEF1234/+ABCD1234=</string>

From the above example: abcd1234/abcDEF1234/+ABCD1234=
id
string
{DeviceUid}
name string
{DeviceFriendlyName}
location string Name of the location in your Kitcast Dashboard
locationID string ID of the location in your Kitcast Dashboard

5. Save and Publish Assignment

  1. If necessary, click Add Assignment to add any additional assignments (including differing application configuration values).
  2. Click Save and then Publish.

Deploying Carousel for Digital Signage

Overview

Carousel is digital signage content management software that allows you to quickly create, publish and manage your message. It all started back in 1997 when one of our founders was working for an audiovisual integrator. His job was to train teachers how to use multimedia authoring software to put the school lunch menu on the tube TVs that were hung in the hallways. This was a frustrating job because the teachers just did not understand how the software worked, which led to training them over and over again. Until we had our aha moment! It wasn't that the teachers were not smart, it was that the tool wasn’t made for them. This is when the founders set out to make “signage” software that everyone could use! This core principle is still core to Carousel over 20 years later.

Prerequisites

Before configuring Carousel Cloud Player in Workspace ONE, you must get some prerequisite information from within the Carousel Console as follows:

Locate Media Player Setup



  1. Click the Gear menu.
  2. Click Configure.
  3. Click Players.
  4. On the next page, click Media Players.
  5. Click Setup New Player.

Locate AppConfig Key-Value Pairs

  1. Expand Apple TV.
  2. Choose the Provisioned Channel to show on the Apple TV(s).
  3. Copy the key-value pairs you'll need in later steps.

Deploying Carousel Cloud Player to tvOS

1. Select Carousel App to Deploy



  1. Click Resources.
  2. Expand Apps and click Native.
  3. Click the Purchased tab.
  4. Select the Carousel Cloud Player app for tvOS.
  5. If not already done (see Bulk-Enabling Device-Based Licensing), click More Actions > Enable Device Assignment, and click OK.
  6. Click Assign.

2. Assign and Allocate App

  1. Enter a name for your app assignment.
  2. Select the Smart Group that contains the tvOS devices.
  3. Enter the number of volume-purchased licenses to allocate to this assignment.
  4. Choose Auto as the deployment method.

NOTE:  More information on creating Smart Groups for tvOS can be found in Creating tvOS Assignment Groups.

3. Configure App Restrictions

Workspace ONE UEM Console
  1. Click Restrictions.
  2. Enable Remove on Unenroll.
  3. Enable Prevent Removal.

4. Enable App Configuration



  1. Click Application Configuration.
  2. Enable Send Configuration.
  3. Click Add.
  4. Enter the key name, value type, and value as noted below.
  5. Add additional key/value pairs by clicking Add and entering additional Application Configuration information.
  6. Click Create.
Configuration Key Value Type Configuration Value
server string Your Carousel Cloud URL (typically https://<yourcarouselcloud>.carouselsignage.net
udid
string
{DeviceUid}
key string
Your Unique Configuration String provided by Carousel
channelID integer The specific provisioned channel that the Carousel Cloud Player should play

5. Save and Publish Assignment

  1. If necessary, click Add Assignment to add any additional assignments (including differing application configuration values).
  2. Click Save and then Publish.

Deploying Exhibit for Digital Signage

Overview

Exhibit (previously known as "MDM Image Viewer") is a managed screensaver app for tvOS created by the University of Nebraska Information Technology Services. With Exhibit, you can customize the Apple TVs in your collaborative spaces by displaying curated images and videos to your users. If configured, the App also displays an AirPlay box similar to Conference Room Display mode so users can easily identify the device.

Features:

  • Run the App in single App mode and automate your processes for a zero-touch deployment.
  • Give content curators access to managing the background content playlist.
  • Allow your Apple TV to double as digital signage (and an AirPlay device if configured).

Prerequisites

Before configuring Exhibit in Workspace ONE, you must satisfy the following requirements as outlined by the Exhibit Documentation:

NOTE: University of Nebraska has provided the following demo CSV file and content:  https://raw.githubusercontent.com/NU-ITS/Exhibit/master/Demo/Playlist.csv

Deploying Exhibit to tvOS

The following steps outline the process for deploying Exhibit to Apple TV devices for digital signage.

1. Select Exhibit App to Deploy



  1. Click Resources.
  2. Expand Apps and click Native.
  3. Click the Purchased tab.
  4. Select the Exhibit app for tvOS.
  5. If not already done (see Bulk-Enabling Device-Based Licensing), click More Actions > Enable Device Assignment, and click OK.
  6. Click Assign.

2. Assign and Allocate App

  1. Enter a name for your app assignment.
  2. Select the Smart Group that contains the tvOS devices.
  3. Enter the number of volume-purchased licenses to allocate to this assignment.
  4. Choose Auto as the deployment method.

NOTE: More information on creating Smart Groups for tvOS can be found in Creating tvOS Assignment Groups.

3. Configure App Restrictions

Workspace ONE UEM Console
  1. Click Restrictions.
  2. Enable Remove on Unenroll.
  3. Enable Prevent Removal.

4. Enable App Configuration



  1. Click Application Configuration.
  2. Enable Send Configuration.
  3. Click Add.
  4. Enter the required key name, value type, and value as noted below.
  5. Add optional key/value pairs by clicking Add and entering additional Application Configuration information.
  6. Click Create.
Configuration Key Value Type Configuration Value
edu.nebraska.ImageViewer.dataURL
string [Required] The https url to the comma-separated value (CSV) playlist file (example: https://raw.githubusercontent.com/NU-ITS/Exhibit/master/Demo/Playlist.csv )
edu.nebraska.ImageViewer.imageTimer
integer Time (in seconds) of the image timer default if no time value is specified in the CSV.
edu.nebraska.ImageViewer.airplayViewHide
boolean Hide the floating AirPlay box.
edu.nebraska.ImageViewer.airplayViewHideOnVideo
boolean Hide the floating AirPlay box when a video is shown.
edu.nebraska.ImageViewer.airplayViewTimer
integer Time (in seconds) between AirPlay box movement.
edu.nebraska.ImageViewer.dataCheckTimer
integer Time (in seconds) between checks for updates to the CSV file.
edu.nebraska.ImageViewer.defaultBackground
string Allows logo removal from the background image.
edu.nebraska.ImageViewer.airplayDescription
string Change the description in the AirPlay box.
edu.nebraska.ImageViewer.airplaySubtitle
string Change the subtitle in the AirPlay box.
edu.nebraska.ImageViewer.airplayViewPositionX
integer Set the default position of the AirPlay box on the X axis.
edu.nebraska.ImageViewer.airplayViewPositionY
integer Set the default position of the AirPlay box on the Y axis.
edu.nebraska.ImageViewer.airplayViewMovement
string Set the movement behavior of the AirPlay box.
edu.nebraska.ImageViewer.playVideosInFull
boolean Override the “duration” value for videos noted in the CSV file.
edu.nebraska.ImageViewer.playVideosWithAudio
boolean Set whether videos play with audio.

5. Save and Publish Assignment

  1. If necessary, click Add Assignment to add any additional assignments (including differing application configuration values).
  2. Click Save and then Publish.

Summary and Additional Resources

Conclusion

This operational tutorial provided instructions on how to configure typical signage use-cases for Apple TV using Workspace ONE to deploy and configure Apple TV in much the same way as other Apple devices.

Procedures included:

  • Integrating Apple Business Manager for tvOS Apps
  • Integrating Apple Business Manager for tvOS Enrollment
  • Configuring Apple TV Payloads
  • Deploying Kitcast for Digital Signage
  • Deploying Carousel for Digital Signage
  • Deploying Exhibit for Digital Signage

Additional Resources

Changelog

The following updates were made to to this guide:

Date Description of Changes
6/11/2021 Initial Publication

 


About the Authors and Contributors

This tutorial was written by:

  • Robert Terakedis, Senior Technical Marketing Manager, End-User-Computing Technical Marketing, VMware

Feedback

Your feedback is valuable. 

To comment on this tutorial, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.

Filter Tags

Workspace ONE Workspace ONE UEM Document Operational Tutorial Intermediate