]

Solution

  • Workspace ONE

Type

  • Document

Level

  • Intermediate

Category

  • Operational Tutorial

Product

  • Workspace ONE UEM

OS/Platform

  • Android

Phase

  • Deploy

Managing Android Devices: VMware Workspace ONE Operational Tutorial

VMware Workspace ONE UEM 9.4 and later

Overview

Introduction

VMware provides this operational tutorial to help you with your VMware Workspace ONE® environment. This tutorial covers basic configuration and management for three different Android device modes; Work Managed (corporate-owned), Work Profile (BYOD), and corporate owned personally enabled (COPE) which combines the previous two modes.

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. Both current and new administrators can benefit from using this tutorial. Familiarity with networking and storage in a virtual environment is assumed, including Active Directory, identity management, and directory services. Knowledge of additional technologies such as VMware Workspace ONE® Access (formerly VMware Identity Manager) and VMware Workspace ONE® UEM is also helpful.

Getting Started with Android Device Management

Introduction

This section helps you to get started with Android Management and to understand the following device modes and their associated use cases:

  • Android Managed
  • Android BYOD
  • Android COPE

After you confirm which device mode best suits your use case, you are ready to register for Android EMM in the Workspace ONE UEM Console. Finally, you learn about configuration options for Android profiles.

You must complete this section before proceeding to the next exercise. 

Prerequisites

Before you can perform this exercise, you must meet the following requirements.

  • Workspace ONE UEM version 9.4 and later

This exercise requires specific account information. Gather the required account information, and record it in the following table. The account information provided in the table is based on a test environment. Your account details will differ.

Workspace ONE UEM Account Information
Server URL  https://<WorkspaceONEUEMHostname>
User name
administrator
Password VMware1!
Google Admin Account Information
Email  WorkspaceONEadmin@gmail.com

Understanding Android Device Modes

To address a variety of device-ownership use cases, Workspace ONE UEM supports multiple management modes for Android. The easiest way to determine which device mode is the most appropriate for your organization is to evaluate your device-ownership use case.

The following table pairs each device-ownership use case with its coordinating device mode. Review this table, and double-check that the tutorial you are reading will best address your use case.

Use Case Device Mode
BYOD
Work Profile
Corporate-Owned Work Managed
Hybrid COPE

Each device mode offers a unique device-side user experience. After you have determined which device mode best addresses your use case, it is important to understand the user experience that mode offers. To help you understand their key similarities and differences, the following table outlines some of the primary device-side capabilities of each mode.

 
Work Profile Work Managed COPE
Entire Device Management No Yes Yes
Badged Enterprise Apps Yes No Yes
Dedicated Personal Apps Yes No Yes

Logging In to the Workspace ONE UEM Console

To deploy a 3rd party macOS app, you must first log in to the Workspace ONE UEM Console.

1. Launch Chrome Browser

Launch Chrome Browser

On your desktop, double-click the Google Chrome icon.

3. Authenticate In to the Workspace ONE UEM Console

Workspace ONE UEM login screen
  1. Enter your Username, for example, administrator.
  2. Click Next. After you click Next, the Password text box is displayed.
Workspace 1 login
  1. Enter your Password, for example, VMware1!
  2. Click Login.

Note: If you see a Captcha, be aware that it is case sensitive.

Registering for Android EMM

After logging into the Workspace ONE UEM console, you register your enterprise with Google. This creates an admin account that connects Google with Workspace ONE UEM.

2. Begin Google Registration

Managing Android devices with Android EMM
  1. Select Devices & Users.
  2. Expand Android.
  3. Select Android EMM Registration.
  4. Click Register with Google.

3. Provide a Google Admin Account

Provide Google Admin Account
  1. Confirm you are logged into your Google Admin Account that you want to associate with your Android for Work configuration. For example, enter WorkspaceONEadmin@gmail.com. Note: After you register a Google Admin Account to Android for Work, you cannot disassociate your Google Admin Account from that Organization. Ensure the Google Admin Account shown is the account you want to associate with your Organization.
  2. Click Get Started.

4. Provide Organization Details

Confirm your Organization Details to manage Android devices
  1. Enter your Organization Name.
  2. Select the Google Play Agreement.
  3. Click Confirm.

5. Complete Registration

Complete Android EMM registration to manage Android devices

Click Complete Registration to return to the Workspace ONE UEM Android Enterprise configuration.

6. Confirm Integration in the Workspace ONE UEM Console

Confirm Android EMM registration to manage Android devices

Return to the Android EMM Registration page in the Workspace ONE UEM Console:

  1. On the Configuration tab, scroll down to the Google Admin Console Settings section. Note that the account information you provided to Google displays here.
  2. Confirm the Android Enterprise Registration Status is shown as Successful.
  3. Note how the Client ID and Google Service Account Email Address have been automatically created and configured.  

Understanding Configuration Options for Android Profiles

Profiles are the mechanism by which Workspace ONE UEM manages settings on a device. All profiles are broken down into two basic sections; the General section and the Payload section.

  • The General section defines the profile's name and assignment settings.
  • The Payload sections define actions to be taken on the device.

Every profile must have all required fields in the General section properly filled out and at least one payload configured.

To address multiple device ownership use cases, you can enable Android profile payload settings in Workspace ONE UEM at the Work Profile level and at the Work Managed device level.

  • Work Profile-level configurations only apply restrictions and settings to the device's badged enterprise apps, and do not affect the users personal apps or settings.
  • Work Managed device-level configurations apply restrictions and settings to the entire device.
  • Corporate Owned Personally-Enabled devices use Work Profile-level and Work Managed device-level configurations

Managing Android Devices

Introduction

This exercise walks-through deploying an Android in Work Managed Device mode. Work Managed Device mode allows Workspace ONE UEM to control the entire device and enforce an extended range of policy controls but restricts the device to only corporate use.

Enrolling Android Devices

Device enrollment establishes communication with the Workspace ONE UEM console and allows devices to access internal resources. To enroll into Workspace ONE UEM, Work Managed devices must use a parent staging process. In this exercise, you enroll an Android Work Managed device using a unique identifier.

The procedures are sequential and build upon one another, so make sure that you complete each procedure in this section before going to the next procedure.

Although this exercise walks through the Workspace ONE Intelligent Hub Identifier enrollment flow, there are several additional enrollment options for Work Managed Android devices.

For an overview of the available enrollment flows, see Work Managed Device Enrollment.

Prerequisites

Before you can perform the exercises in this tutorial, you must meet the following requirements.

Caution: Do not factory reset your personal device to complete these exercises.

This exercise requires a user to enroll their device into Workspace ONE UEM. Note the information in the following table. The details provided in this table are based on a test environment. Your user account details will differ.

User Account Information

User name
testuser
Password VMware1!
Workspace ONE Server URL workspaceoneuemhostname.com

Enrolling an Out-Of-Box Android Device using Workspace ONE Intelligent Hub Identifier

In this activity, use Workspace ONE Intelligent Hub Identifier enrollment to set up your device in Work Managed Device mode.

Note: Screenshots may differ due to differences in device models and operating system versions.

1. Begin Enrollment

Manage Android devices by enrolling with Workspace ONE Intelligent Hub

Turn on your device from a factory reset state and tap the arrow.

2. Accept EULA

Manage Android devices and accept the EULA
  1. Accept the End User License Agreement.
  2. Tap Next.

3. Skip Data Import (If Needed)

Manage Android devices and skip data import
  1. Tap Skip this for now.
  2. Tap Next.

4. Connect to Wi-Fi

  1. Tap to connect to the appropriate Wi-Fi network based on your location.
  2. After connecting to Wi-Fi, tap Next.

5. Enter the Workspace ONE Intelligent Hub Identifier

  1. Enter afw#hub into the Email or phone text box to download the Workspace ONE Intelligent Hub.
  2. Tap Next.

6. Install the Agent

Tap Install.

7. Confirm Agent Installation

Tap Install.

8. Continue to Set Up Device

Tap Accept & continue.

Configuring Workspace ONE UEM Server Details

After the agent has launched, you can enroll the device. In this activity, configure Workspace ONE UEM authentication details.

1. Enter Server URL

  1. Enter the Workspace ONE UEM server URL.
  2. Tap Next.

2. Enter the Group ID

  1. Enter the Group ID you retrieved from the Workspace ONE UEM Console for the Group ID field.
  2. Tap Next.

3. Enter the Agent Credentials

  1. Enter the username. For example, testuser.
  2. Enter the password. For example, VMware1!.
  3. Tap Continue.

Completing Android Device Enrollment

After the device restarts, you are ready to complete device enrollment. During the enrollment process, you will see several processing screens. You do not need to interact with the device further until you see the Workspace ONE Intelligent Hub app confirming your enrollment.

1. Accept Privacy Statement

Review the privacy statement and tap I Understand.

2. Accept Data Sharing Statement

Tap I Agree.

3. Confirm Android for Work Setup

You will see a number of different processing screens during the Work Account setup.

4. Confirm Account Details

After the device has completed enrollment, you can see the user account details. Tap This Device to view the device status.

5. Confirm Device Enrollment

It may take several minutes to establish a connection to Google Cloud Messaging. Wait until you see the Connectivity Issue notification change to Connectivity Normal before continuing.

You have now completed the agent configuration wizard. You can now exit the agent.

Configuring Android Profiles

In this exercise, set up and configure a restrictions profile in Workspace ONE UEM to explore how enterprise profile settings apply on an Android device.

Prerequisites

Before you can complete this exercise, you must successfully enroll an Android device in Work Managed mode.

Configuring a Restrictions Profile for an Android Device

In this activity, control camera settings by configuring a restrictions profile for a Work Managed Android device in the Workspace ONE UEM console.  

1. Create a New Profile

Manage Android devices by configuring profile in Workspace ONE UEM admin console

In the Workspace ONE UEM Console:

  1. Click Add.
  2. Click Profile.

2. Select the Android Platform

Select Android.

3. Configure the General Settings

Manage Android devices and configure profile general settings in Workspace ONE UEM admin console
  1. Select General.
  2. Enter a name for the Android Profile. For example, Android Restriction.
  3. Click Assigned Groups to display the list of available assignments.
  4. Select All Devices.

4. Open the Restrictions Payload

  1. Select the Restrictions payload.
  2. Click Configure.

5. Configure Screen Capture Restrictions

Manage Android devices and configure restrictions for profile

Under Device Functionality:

  1. In the Work Managed Device column, deselect the Allow Screen Capture check box.
  2. Ignore the settings in the Work Profile column — they do not apply on a device in Work Managed mode.

6. Configure Camera Restrictions

  1. Scroll down to the Application section.
  2. In the Work Managed Device column, deselect the Allow Camera check box.
  3. Ignore the settings in the Work Profile column — they do not apply on a device in Work Managed mode.
  4. Click Save & Publish.

7. Publish the Profile

Click Publish.

Testing an Android Device Restriction Profile

For Android, the various device modes change the way profile settings apply to devices. After configuring a restriction profile, test the profile settings to see how they applied on your Work Managed Android device.

1. Verify Camera Restrictions

After the restrictions profile pushes to the device, notice that the camera application is not available.

2. Test Screenshot Restrictions in Contacts

Verify the Android for Work Screen Shot Restriction

Open your Contacts app, and try to take a screenshot within the app. Notice that the screen shot is not successful. In certain device models and OS versions, a message may also appear.

Deploying Android Applications

After an Android enrolled in Work Managed Device mode is activated, the end user can access various applications pre-loaded on the device. Any additional applications can only be approved and added through the Workspace ONE UEM console.

In this section, walk through approving applications for Workspace ONE UEM and Android Enterprise integration. Integrated applications have the same functionality as their Google Play Store counterparts, plus the additional security features that come with Workspace ONE UEM.

Prerequisites

Before you can complete this exercise, you must successfully enroll an Android device in Work Profile mode.

Deploying Workspace ONE Web to an Android Device

In this exercise, you deploy Workspace ONE Web, a public application, to your Android device. Applications that you push through the integration of Workspace ONE UEM and Android Enterprise have the same functionality as their counterparts from the Google Play Store. However, you can use Workspace ONE UEM features to add functionality and security to these applications.

1. Add Public Application

Manage Android devices and Add a Public Application in Workspace ONE UEM admin console.

In the Workspace ONE UEM Console:

  1. Select Add.
  2. Select Public Application.

2. Search for Workspace ONE Web

Manage Android devices and search for Workspace ONE Web in Workspace ONE UEM admin console
  1. Select Android from the Platform drop-down menu.
  2. Select Search App Store for the Source.
  3. Enter Web in the Name text box.
  4. Click Next.

3. Select the Web - Workspace ONE App

Click the Web app.

4. Approve Web - Workspace ONE

If prompted, click Approve.

5. Confirm Approval for Web - Workspace ONE

Click Approve again in the Application pop-up window.

Note: Scroll down if you do not see the pop-up window.

6. Save Approval Settings

You may need to scroll down to view the Approval Settings button.

  1. Select Keep approved when app requests new permission.
  2. Click Save.

7. Publish the App

Click Save & Assign.

8. Add Assignment

Click Add Assignment.

9. Configure Assignment

  1. Click in the Selected Assignment Groups search box. From the list of Assignment Groups that appear, select the appropriate group. For example, select All Devices (your@email.shown.here).
  2. Select Auto for the App Delivery Method.
  3. Click Add.

10. Save and Publish Web - Workspace ONE App

Click Save & Publish.

11. Preview Assigned Devices and Publish

Click Publish.

Verifying Workspace ONE Web on Android

After using the Workspace ONE UEM console to push Workspace ONE Web to your Android device, verify the Work app installed correctly on your device.

Note: Screenshots may differ depending on device model and OS.

1. Confirm the Published Workspace ONE Web Application Downloaded

Return to your testing Android device and confirm that the Workspace ONE Web application has downloaded and displays as a Work app.

Using this process, you can rapidly approve new applications and deploy them to your users.

2. Open the Badged Android for Work Play Store App

Open the Badged Android for Work Play Store App

Open your Work Play Store application on your Android device.

3. Accept Google Play Terms of Service (IF NEEDED)

If you are prompted with the Google Play Terms of Service, tap Accept. Otherwise, continue to the next step.

4. Open Play Store Menu

Open Play Store Menu

Tap the Menu button in the upper-left corner.

5. View Play Store Work Apps

View Play Store Work Apps

Tap My Work Apps from the menu.

6. Verify Workspace ONE Web Is Available As A Work App

  1. Tap Installed.
  2. Confirm that the Workspace ONE Web application is in your list of Work applications. You may need to scroll down to find the application.

The Workspace ONE Web app is listed as a Work app because it was approved as a Work app through the Workspace ONE UEM Console while adding and assigning the application to your users. This streamlines and rapidly improves the process of approving and deploying Work apps to your Android devices.

Managing Android BYOD

Introduction

This section includes a series of exercises that walk you through deploying Android BYOD in Work Profile mode. The Work Profile creates a dedicated device container for business applications and content. Although this mode enables you to manage the business data and applications in the container, you cannot manage the user's personal data and apps. To help end users distinguish business apps from their personal apps, the business apps are marked with a briefcase icon.

Enrolling Android BYOD

Device enrollment establishes communication with the Workspace ONE UEM console and allows devices to access internal resources. In this exercise, you enroll an Android device in Work Profile mode—which sets the device up with a special type of administrator. You begin enrollment with a device that already has a user account associated with it. Then, you enroll the device which installs the Work Profile and adds the Workspace ONE Intelligent Hub as the profile owner.

Prerequisites

Before you can perform the exercises in this tutorial, you must meet the following requirements.

This exercise requires a user to enroll their device into Workspace ONE UEM. Note the user account information in the following table. The details provided in this table are based on a test environment. Your user account details will differ.

User Account Information

User name
testuser
Password VMware1!
Workspace ONE UEM Information
Workspace ONE Server URL labs.awmdm.com

Enrolling into Android Work Profile Mode

In this section, enroll your device in Workspace ONE UEM and set it up in Work Profile mode. You need to encrypt data on your device during this process. Depending on the amount of data on your device, this can take some time. Be patient until you see the next enrollment prompt.

Note: Screenshots may differ due to differences in device models and operating system versions.

1. Download the Workspace ONE Intelligent Hub

Navigate to https://www.getwsone.com to download the latest version of Workspace ONE Intelligent Hub (formerly the AirWatch Agent).

2. Launch the Workspace ONE Intelligent Hub

Launching the AirWatch MDM Agent

Launch the Hub app on the device.  

3. Enter the Server URL

  1. Enter the Server URL for your Workspace ONE UEM environment.
  2. Tap Next.

4. Enter the Group ID for Workspace ONE Intelligent Hub

Return to the Workspace ONE Intelligent Hub application on your Android device,

  1. Enter your Group ID for your Organization Group for the Group ID text box. See Retrieving the Group ID from Workspace ONE UEM Console.
  2. Tap the Next.

5. Enter User Credentials

Authenticate the AirWatch MDM Agent

You now provide user credentials to authenticate to Workspace ONE UEM.

  1. Enter the Username. For example, testuser.
  2. Enter the Password. For example, VMware1!.
  3. Tap the Next button.

6. Accept Privacy Statement

Tap I Understand.

7. Accept Data Sharing Statement

Tap I Agree.

8. Accept the Terms and Conditions

Tap Agree.

9. Set Up the Work Profile

Tap Set Up.

Note: This may take some time, be patient while the setup process completes.

10. Encrypt Device

Tap Encrypt.

After encryption has completed, enter your device PIN at the prompt to continue with enrollment.

11. Agree to Privacy Policy

Administrator Rights

Tap OK to confirm the Privacy Policy.

During the enrollment process, you will see several processing screens. You do not need to interact with the device further until you see the Hub app confirming your enrollment.

12. Wait for Device Connectivity (IF NEEDED)

Device Connectivity

If you see a Connectivity Issue notification, the device may be taking several minutes to establish a connection to Google Cloud Messaging. Wait until you see the Connectivity Issue notification change to Connectivity Normal before continuing.

Note: If you do not see any Connectivity Issue notifications, continue to the next step.

13. Confirm Device Enrollment

You have now completed the Hub configuration wizard. After the enrollment process completes, the Agent  displays the notification Congratulations! You have successfully enrolled your device.

You can now Exit the agent.

Configuring Profiles for Android BYOD

Profiles are the mechanism by which Workspace ONE UEM manages settings on a device. In this exercise, you set up and configure a restrictions profile in Workspace ONE UEM to explore how enterprise profile settings apply on an Android device in Work Profile mode.

Prerequisites

Before you can complete this exercise, you must successfully enroll an Android device in Work Profile mode.

To create a new restrictions profile, follow steps 1 to 4 in Configuring Android Profiles. Then, continue to the next step.

Configuring a Restrictions Profile

In this exercise, control camera settings by configuring a restrictions profile in the Workspace ONE UEM console.  

1. Configure Screen Capture Restrictions

Under Device Functionality:

  1. In the Work Managed Device column, select the Allow Screen Capture check box.
  2. In the Work Profile column, deselect the Allow Screen Capture check box.

2. Configure Camera Restrictions

  1. Scroll down to the Application section.
  2. In the Work Managed Device column, select the Allow Camera check box.
  3. In the Work Profile column, deselect the Allow Camera check box.
  4. Click Save & Publish.

3. Publish the Profile

Click Publish.

Testing Android Restriction Settings

For Android, the various device modes change the way profile settings apply to devices. After configuring a restriction profile, test the profile settings to see how they applied on the Android device.

1. Verify Camera Restrictions

After the restrictions profile pushes to the device:

  1. Notice that a badged enterprise version of the camera application is not available.
  2. Notice that the unbadged personal camera remains available.

2. Test Screenshot Restrictions in Personal Contacts

Verify the Android for Work Screen Shot Restriction

Open your non-badged Contacts app, and try to take a screenshot within the app. Notice that the screen shot was successful.

3. Test Screenshot Restriction in Enterprise Contacts

Verify the Android for Work Screen Shot Restriction

Open the badged Contacts app, and try to take a screenshot within the app. Notice that the screenshot was unsuccessful. In certain device models and OS versions, a message may also appear.

Deploying Android BYOD Applications

Follow the steps outlined in Deploying Android Applications.

Managing Corporate Owned Personally Enabled Devices

Introduction

This exercise walks-through deploying an Android device in Corporate Owned Personally-Enabled (COPE) mode. Android COPE devices give Workspace ONE UEM control of the entire device, but also dedicate a separate space for personal use.

Enabling Corporate Owned Personally-Enabled Mode

In this exercise, you enable Corporate Owned Personally-Enabled devices. Before you can complete this exercise, you must register Android for EMM with Workspace ONE UEM.

2. Configure Enrollment Settings

  1. On the Android EMM Registration page, click Enrollment Settings.
  2. Next to Fully-Managed Device Enrollments, select Corporate Owned Personally Enabled.
  3. Click Save.

Enrolling Android COPE Devices

Device enrollment establishes communication with the Workspace ONE UEM console and allows devices to access internal resources. In this exercise, generate a QR code in the Workspace ONE UEM console, and use it to enroll your Android COPE device.

Although this exercise walks through QR code enrollment, there are several additional enrollment options for Android COPE devices:

  • AirWatch Relay
  • Unique Identifier
  • Zero Touch

Prerequisites

Before you can perform the activities in this exercise, you must meet the following requirements:

Warning: Do not factory reset your personal device to complete these exercises.

This exercise requires a user to enroll their device into Workspace ONE UEM. A staging account is also required to setup enrollment. Gather the required account information, and record it in the following table. The account information used in this exercise is based on a test environment. Your account details will differ.

Staging User Account Information

User name
staging
Password VMware1!
User Account Information
User name admin
Password VMware1!

Configuring the Enrollment QR Code

Before you can enroll your device, you must generate the enrollment QR Code in the Workspace ONE UEM console.

Manage Android devices and generate QR code

In the Workspace ONE UEM console, in the appropriate Organization Group:

  1. Click Devices.
  2. Click Staging & Provisioning.
  3. Click Staging.
  4. Click Configure Enrollment.

2. Open the Enrollment Configuration Wizard

Manage Android devices and configure QR code

On the Enrollment Configuration Wizard page that appears:

  1. Under Platform, click Android.
  2. Under Enrollment, select QR Code.
  3. Click Configure.

3. Configure Wi-Fi Settings

Manage Android devices and configure wifi settings

In the enrollment wizard, configure Wi-Fi settings for enrollment:

  1. Set Connect device to Wi-Fi prior to enrollment to Enabled.
  2. Enter your Wi-Fi network name or SSID. For example, VMware Guest.
  3. Enter your Wi-Fi Password.
  4. Click Next.

4. Configure Hub Settings

Manage Android devices and install Workspace ONE Intelligent Hub
Click Next
  1. From the Workspace ONE Intelligent Hub drop-down menu, select Use latest Workspace One intelligent Hub.
  2. Click Next.

5. Configure Enrollment Details

Click Next
  1. Set Configure Organization Group to Enabled.
  2. Select your Organization Group.
  3. Set Login Credentials to Enabled.
  4. Enter a User Name. For example, staging.
  5. Enter your Password.
  6. Click Next.

6. Download the QR Code

On the Summary tab:

  1. Click Download File and save your QR code to a secure, accessible location.
  2. Click Close.

Enrolling Using the QR Code (Video)

The QR code you generated in the Workspace ONE UEM console contains a payload of key-value pairs with all the information the device needs to enroll. In this section, follow-along with the steps in the video to enroll your Android COPE device using the QR code you generated.

Configuring Android COPE Profiles

In this exercise, set up and configure a restrictions profile in Workspace ONE UEM to explore how enterprise profile settings apply on an Android COPE device.

Prerequisites

Before you can complete this exercise, you must successfully enroll an Android device in COPE mode.

To create a new restrictions profile, follow steps 1 to 4 in Configuring Android Profiles. Then, continue to the next step.

Configuring Restrictions Profile

In this exercise, control camera settings by configuring a restrictions profile in the Workspace ONE UEM console.

1. Configure Screen Capture Restrictions

Manage Android devices for COPE and configure restrictions profile

Under Device Functionality:

  1. In the Work Managed Device column, select the Allow Screen Capture check box.
  2. In the Work Profile column, deselect the Allow Screen Capture check box.

2. Configure Camera Restrictions

Manage Android devices and configure camera restrictions
  1. Scroll down to the Application section.
  2. In the Work Managed Device column, select the Allow Camera check box.
  3. In the Work Profile column, deselect the Allow Camera check box.
  4. Click Save & Publish.

3. Publish the Profile

Click Publish.

Testing Android Restriction Settings

For Android, the various device modes change the way profile settings apply to devices. After configuring a restriction profile, test the profile settings to see how they applied on the Android device.

1. Verify Camera Restrictions

After the restrictions profile pushes to the device:

  1. Notice that a badged enterprise version of the camera application is not available.
  2. Notice that the unbadged personal camera remains available.

2. Test Screenshot Restrictions in Personal Contacts

Verify the Android for Work Screen Shot Restriction

Open your non-badged Contacts app, and try to take a screenshot within the app. Notice that the screen shot was successful.

3. Test Screenshot Restriction in Enterprise Contacts

Verify the Android for Work Screen Shot Restriction

Open the badged Contacts app, and try to take a screenshot within the app. Notice that the screenshot was unsuccessful. In certain device models and OS versions, a message may also appear.

Deploying Applications to Android COPE Devices

Follow the steps outlined in Deploying Android Applications.

Migrating Android Device Administrator (Legacy) to Android Enterprise

Introduction

The Workspace ONE UEM console provides a seamless process that helps you migrate all devices from Android (Legacy) to a Work Profile for Android Enterprise. The migration features in the UEM console help you to ensure that:

  • Your legacy administration remains intact until migration is complete.
  • Devices not being migrated are never affected.
  • Monitor which devices are complete, in progress, and assigned.
  • Create staging or test Smart Groups to make sure that all user devices successfully migrate before migrating your entire device fleet.

Prerequisites

Before you can perform the steps in this exercise, you must have the following components installed and configured:

  • Workspace ONE UEM 1907 and later
  • Android Devices enrolled into Workspace ONE UEM using Android (Legacy) deployment 

You must also satisfy the following requirements:

  • Recreate profiles – reapply Android (Legacy) profiles as new Android Enterprise profiles before migration. For more information, see Android Profiles Overview.
  • Publish internal apps – All apps must be reinstalled. Existing app data would also be lost during the migration. For more information, see Application Management for Android.
  • Verify network settings – Confirm your network connection between Workspace ONE and the Google Play Store. For more information, see Network Requirements for Android.
  • Approve public apps – Ensure that every public app is approved for your organization. For more information, see Application Management for Android.

The Legacy Android Migration page lists each of these prerequisite steps under How to Get Started.

The migration wizard will remind you to complete these prerequisite steps before continuing with the migration.

Creating New Migration

The Workspace ONE UEM console provides a migration tool that allows you to complete all prerequisites, select smart groups, configure a custom message for your users, and a dashboard to view a summary page of the migrated devices including eligilibity status and reason for failure or success.

1. Launch New Migration Wizard

  1. Navigate to Devices > Lifecycle > Legacy Android Migration.
  2. Select New Migration.

2. Confirm Pre Requisites

Complete the prerequisites and select Next to move to the Details tab.

3. Enter Migration Details

The Details tab allows you to select the Smart Groups that you want to migrate.

  1. Enter a friendly name for the migration group, for example, Legacy Android Group.
  2. Enter a details description for the migration.
  3. Specify which smart groups to receive the migration. Smart Groups must include Android (Legacy) deployments.
    You will receive an error message if a Smart Group is not eligible to be included in the migration.
  4. Enter a message. After users have chosen to upgrade to Android Enterprise, this message will inform them about the migration and prompt them to take action to proceed.
  5. Select Validate. Selecting validate retrieves the number of devices eligible for migration.
    A notification is sent to eligible devices in the selected Smart Groups informing users about migration and prompting them to perform necessary actions to proceed. You can monitor progress on the Legacy Android Migration page.

4. Confirm Summary Details

  1. Select Next after all devices are validated for migration. You cannot select next until a valid Smart Group is selected.
    A Summary page displays showing details such as list of devices, eligibility of migration, and reason the device migrated successfully or failed.
  2. Select Create to display the migration List View to review the status of devices being migrated. From this page you can select migrations from the list view to display the Migration Details page.

Note: During Android (Legacy) migration to Android Enterprise, based on the setting in the Scheduler, the migration command is automatically sent for the first batch size (300) of devices instantly. After the first 300 devices, the remaining devices will receive the command at the determined intervals. You can view the settings in the UEM console under Admin > Scheduler.

Reviewing Migration Details Page

This section provides an overview of the Migration Details Page.

Review Legacy Android Migration List View

The Legacy Android Migration List View automatically displays after you create a new migration page. The list view helps you to view all the real-time updates of your end-user devices that you are migrating with the Workspace ONE UEM console. The list view allows you to:

  • Edit specific migrations by selecting the radio button on the desired migration friendly name. You can update the migration for new devices added to the Smart Group by selecting Edit.
  • Delete migration groups that prevent devices in the queue from migrating from Legacy Android by withdrawing the persistent notification. Android Work Profile is not removed from devices that have already migrated.
  • Search and narrow down a device using the Search option.

Review Legacy Android Migration Details Page

The Migration Details page is accessed by selecting a migration Friendly Name from the Legacy Android Migration List View with the Workspace ONE UEM console to review the status of the migration. You can view a graphical overview, status, and reason for the migration failing or succeeding.

  • Use the Migration Details page to push the migration command to the device with the Retry button if the migration fails.
  • Customize a message to the devices in the migration batch with the Notify button. Configure the field as follows:
    • Message Type: Select the message type (email, SMS, or push) that Workspace ONE UEM uses for this template.
    • Subject: Enter the message subject.
    • Message Body: Enter the message Workspace ONE UEM displays on the end-user devices for each message type.

Different Types of Migration

This section discusses the different types of migration available for Android (Legacy).

Migrate from Android (Legacy) to Android Enterprise with BYOD Devices

The Workspace ONE UEM console provides a seamless process that helps you migrate all devices from Android (Legacy) to a Work Profile for Android Enterprise. The migration features in the UEM console help you to make sure that:

  • Your legacy administration remains intact until migration is complete.
  • Devices not being migrated are never affected.
  • Monitor which devices are complete, in progress, and assigned.
  • Create staging or test Smart Groups to make sure that all user devices successfully migrate before migrating your entire device fleet.

Migrate from Android (Legacy) to Android Enterprise with Corporate Owned Devices

You can migrate from Android (Legacy) to Android Enterprise with your corporate owned devices into Work Managed Mode or Corporate Owned Personally Enabled (COPE). The enrollment and migration options vary depending on Android OS, device type, and whether the devices have access to Google Services.

The migration and enrollment options are:

  • Use Zero Touch enrollment for Android 8.0+ devices.
  • Use Knox Mobile Enrollment for Samsung Android 8.0+ devices.
  • Follow the Cap and Grow strategy and continue to use your current Android devices enrolled through Android (Legacy). A Cap and Grow strategy means that any new device rollouts are automatically enrolled into Android Enterprise and managed simultaneously with older deployments (Android (Legacy) until your organization is ready to move all devices to Android Enterprise.

Migrate from Android (Legacy) to Android Enterprise Without Google Services

If you are currently enrolled into Workspace ONE UEM with Android devices deployed through Android (Legacy) and want to switch to Android Enterprise without Google Services, we offer Closed Network support for corporate owned devices and unmanaged enrollment for BYOD devices.

If you have a device that has no network connectivity or the device can connect to a network but has no Google services (a non-GMS certified device), you can enroll these devices into Android Enterprise into Work Managed Mode and push internal applications and apply policies with Android profiles.

If you have a device that has network connectivity but has restrictions on Google Services, for example devices being in China, you can use Closed Network support for corporate devices. For BYOD devices, you can use SDK-based MAM only mode called Registered Mode to enable unmanaged enrollment for Android devices.

Impact on APIs

Google deprecated certain device administrator APIs in favor of more up-to-date device functionality because device administrator is not well suited to support current enterprise requirements. The following APIs available with device administrator no longer function on devices running Android 10 and later. Devices remaining on Android 9.0 and earlier are not impacted:

  • USES_POLICY_DISABLE_CAMERA
  • USES_POLICY_DISABLE_KEYGUARD_FEATURES
  • USES_POLICY_EXPIRE_PASSWORD
  • USES_POLICY_LIMIT_PASSWORD

Summary and Additional Resources

Conclusion

This operational tutorial provided basic steps to configure and manage Android devices for each of the following device modes:

  • Work Managed (Corporate Owned)
  • Work Profile (BYOD)
  • COPE (Hybrid)

Procedures included:

  • Enrolling Android devices into Workspace ONE UEM
  • Configuring and testing a restrictions profile
  • Deploying Workspace ONE Web to Android and verifying the application

This tutorial also covered migrating Android (Legacy) Device Administrator to Android Enterprise.

For more information, explore the Understand Android Management activity path on Digital Workspace Tech Zone.

Terminology Used in This Tutorial

The following terms are used in this tutorial:

application store A user interface (UI) framework that provides access to a self-service catalog, public examples of which include the Apple App Store, the Google Play Store, and the Microsoft Store.
auto-enrollment Auto-enrollment simplifies the enrollment process by automatically enrolling registered devices following the Out-of-Box-Experience.
catalog A user interface (UI) that displays a personalized set of virtual desktops and applications to users and administrators. These resources are available to be launched upon selection.
cloud Asset of securely accessed, network-based services and applications. A cloud can also host data storage. Clouds can be private or public, as well as hybrid, which is both private and public.
device enrollment The process of installing the mobile device management agent on an authorized device. This allows access to VMware products with application stores, such as Workspace ONE Access (formerly VMware Identity Manager).
identity provider (IdP) A mechanism used in a single-sign-on (SSO) framework to automatically give a user access to a resource based on their authentication to a different resource.
mobile device management
(MDM) agent
Software installed on an authorized device to monitor, manage, and secure end-user access to enterprise resources.
one-touch login A mechanism that provides single sign-on (SSO) from an authorized device to enterprise resources.
service provider (SP)
A host that offers resources, tools, and applications to users and devices.
virtual desktop The user interface of a virtual machine that is made available to an end user.
virtual machine A software-based computer, running an operating system or application environment, that is located in the data center and backed by the resources of a physical computer.

For more information, see the VMware Glossary.

Additional Resources

For more information about Workspace ONE, explore the VMware Workspace ONE Activity Path. The activity path provides step-by-step guidance to help you level-up in your Workspace ONE knowledge. You will find everything from beginner to advanced curated assets in the form of articles, videos, and labs.

Additionally, you can check out the VMware Workspace ONE and VMware Horizon Reference Architecture which provides a framework and guidance for architecting an integrated digital workspace using VMware Workspace ONE and VMware Horizon. 

 

Change Log

The following updates were made to this guide:

Date Change
2020/03/11 Added the chapter: Migrating Android (Legacy) Device Administrator to Android Enterprise. 

About the Author

This tutorial was written by:

  • Karim Chelouati, Senior Technical Marketing Manager, End-User-Computing Technical Marketing, VMware

Feedback

Your feedback is valuable. 

To comment on this tutorial, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.

Filter Tags

  • Workspace ONE
  • Intermediate
  • Operational Tutorial
  • Document
  • Workspace ONE UEM
  • Android
  • Deploy