AirWatch Cntainer Admin Guide Cnfiguring and Deplying AirWatch Cntainer Wrkspace ONE UEM v9.5 Have dcumentatin feedback? Submit a Dcumentatin Feedback supprt ticket using the Supprt Wizard n supprt.air-watch.cm. This prduct is prtected by cpyright and intellectual prperty laws in the United States and ther cuntries as well as by internatinal treaties. VMware prducts are cvered by ne r mre patents listed at http://www.vmware.cm/g/patents. VMware is a registered trademark r trademark f VMware, Inc. in the United States and ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies. 1
Table f Cntents Chapter 1: Overview 3 Intrductin t the AirWatch Cntainer 4 Security and Encryptin 4 Requirements 5 Chapter 2: Initial Cnfiguratins 6 AirWatch Cntainer Enrllment 7 Terms f Use 7 Create Enrllment Terms f Use 8 Cnfigure Prfile Paylads 9 Chapter 3: Applicatin Cnfiguratin 10 Cnfiguring AirWatch Cntainer Settings 11 Chapter 4: Applicatin Deplyment 12 Cnfiguring and Deplying Applicatins 13 Managing frm the Device Dashbard 14 Managing AirWatch Cntainer Devices 14 Appendix: SDK Prfiles, Plicies and Settings Cmpatibility 16 2
Chapter 1: Overview Intrductin t the AirWatch Cntainer 4 Security and Encryptin 4 Requirements 5 3
Chapter 1: Overview Intrductin t the AirWatch Cntainer AirWatch Cntainer ffers a flexible apprach t Bring Yur Own Device (BYOD) management by pushing a secure wrk space t a persnal device. Businesses can distribute Wrkspace ONE UEM applicatins and internal applicatins t the AirWatch Cntainer fr emplyees t use n their mbile devices. Applicatins are visible inside and utside the AirWatch Cntainer, but the enterprise applicatins are secure thrugh a cmmn SDK framewrk and a cntainer passcde. These apps can interact seamlessly using single sign n authenticatin and can cnnect securely t the Internet thrugh an app tunnel VPN. Fr instructins n hw t use the AirWatch Cntainer n a device, see the VMware AirWatch Cntainer User Guide fr ios r the VMware AirWatch Cntainer User Guide fr Andrid. Business Friendly Create a practical and cnvenient slutin fr bth businesses and emplyees. Cst-effective fr emplyers There is n need t buy r distribute crprate devices. Crprate data can be managed and mnitred frm the Wrkspace ONE UEM cnsle. Separatin between wrk and play Persnal data is separated frm crprate data. AirWatch Cntainer cannt track persnal infrmatin and des nt have the ability t wipe any persnal items. Intuitive user experience Add custm branding and custmize menus. Allw users t seamlessly access apps withut entering credentials every time. Easily Managed Take advantage f Wrkspace ONE UEM capabilities while allwing emplyees t use their devices freely. Wrks with a hybrid device deplyment Add AirWatch Cntainer functinality t yur current deplyment. Add devices t the desired rganizatin grup t adpt the settings frm that grup. Uses applicatin-level management Prductivity tls are granted t end users thrugh Wrkspace ONE UEM apps and internal apps that are wrapped. These can be managed at the app-level rather than the device level. N MDM Required End users d nt have t wrry abut MDM restrictins. Emplyees can feel cmfrtable maintaining a single device fr all their needs. Security and Encryptin Standardize security and data lss preventin strategies acrss mbile devices. Enfrces Passcde/Encryptin nly within AirWatch Cntainer Set cmplex passcdes that d nt intrude n persnal use because encryptin is nly enfrced lcally within the applicatins. ios devices are secured with FIPS 140-2 encryptin and allws fr the use f Tuch ID r EyeVerify. Prevents data leakage utside f the app Use Wrkspace ONE UEM security cntrls built int Wrkspace ONE UEM apps, third-party integrated apps, wrapped apps, Web Clips and Bkmarks. Incrprates email With AirWatch Inbx r IBM Ntes Traveler n Andrid devices, end users can access email frm their secure AirWatch Cntainer instead f having t maintain tw devices. 4
Chapter 1: Overview Requirements Meet the fllwing requirements t facilitate a successful deplyment f AirWatch Cntainer: Supprted Devices and Sftware Andrid v4.4+ (KitKat) ios v6.0+ Cnsle Requirements Wrkspace ONE UEM cnsle v6.5 + Other Requirements AirWatch App Catalg enabled fr ios devices 5
Chapter 2: Initial Cnfiguratins AirWatch Cntainer Enrllment 7 Terms f Use 7 Create Enrllment Terms f Use 8 Cnfigure Prfile Paylads 9 6
Chapter 2: Initial Cnfiguratins AirWatch Cntainer Enrllment Each device in yur rganizatin's deplyment must be enrlled befre it can cmmunicate with Wrkspace ONE UEM and access internal cntent and features. Enrll devices using ne f three methds: Basic, Directry, Authenticatin Prxy. Als, AirWatch Cntainer supprts Autdiscvery and Security Assertin Markup Language (SAML) integratin t help simplify enrllment. Enrlling Devices 1. Navigate t Devices > Device Settings > Devices & Users > General > Enrllment > Authenticatin. 2. Select the Authenticatin Mde. Chse either Basic, r Directry, r Authenticatin Prxy methds. Mre Help: T learn abut chsing types f enrllment, see the Enrllment sectin f the VMware Wrkspace ONE UEM Mbile Device Management Guide. 3. If desired, chse t use Autdiscvery t assciate devices with an email dmain. T learn mre, see the Autdiscvery sectin in the VMware Wrkspace ONE UEM Mbile Device Management guide. Integrating with SAML Chse t set up SAML 2.0 integratin t enable single sign n architecture r federal authenticatin. Begin by navigating t Grups & Settings > All Settings > System > Enterprise Integratin > Directry Services. Nte: Fr infrmatin n SAML enrllment, see the VMware AirWatch SAML Integratin guide. Terms f Use Ensure that all users with managed devices agree t the plicy by defining and enfrce terms f use (TOU). If necessary, users must accept the TOU befre prceeding with enrllment, installing apps, r accessing the UEM cnsle. The UEM cnsle allws yu t custmize fully and assign a unique TOU t each rganizatin grup and child rganizatin grup. The terms f use displays during each device enrllment. Get access t the fllwing functins: Set versin numbers Set platfrms t receive the terms f use Ntify users by email with the terms f use updates Create language-specific cpies f the terms f use Create multiple terms f use agreements and assign them t rganizatin grups based n platfrm r the type f wnership Meet the liability requirements f specific grups by custmizing terms f use 7
Chapter 2: Initial Cnfiguratins Create Enrllment Terms f Use Yu can create an agreement abut terms f use (TOU) specific t enrllment purpses. Yu can als limit devices allwed fr enrllment by device platfrm, wnership type, and enrllment type. 1. Ensure that yur current active rganizatin grup is crrect fr the TOU yu are creating. 2. Navigate t Devices > Device Settings > Devices & Users > General > Enrllment and select the Terms f Use tab. 3. Select the Add New Enrllment Terms f Use buttn and cmplete the fllwing ptins. Setting Name Type Versin Platfrms, Device Ownership, and Enrllment Type Descriptin Enter a unique name fr the new TOU. This ptin is pre-ppulated as Enrllment. This ptin is autmatically tracked and ppulated accrdingly. If yu d nt want t make yur TOU fr any specific categry f device, then keep the default selectin f Any fr these ptins. If yu prefer t specify a platfrm, wnership, and enrllment, yu can select ne r mre f these categries and define the limitatins specific t yur TOU. If yu select Selected Platfrm ptin, then chse yur desired platfrms frm the list that appears. Yur TOU applies t the device platfrms yu select, excluding all thers. If yu select Selected Ownership Types ptin, then yu must chse yur desired wnership frm the list that appears. Yur TOU applies t the wnership types yu select, excluding all thers. If yu select Selected Enrllment Types ptin, then yu must chse yur desired enrllment frm the list that appears. Yur TOU applies t the types f enrllment yu select, excluding all thers. Ntificatin Select Language Send an email t users whenever the TOU is updated by selecting this check bx. The ntificatin email is sent when yu select Save in step 5. Optinally, fr lcalizatin purpses, yu may enter a TOU agreement fr each language applicable t yur needs by making a chice in the Select Language drpdwn. 4. In the text bx prvided, enter yur custmized TOU. The editr prvides a basic text entry tl t create a TOU r paste in an existing TOU. T paste text frm an external surce, right-click the text bx and chse Paste as plain text t prevent any HTML r frmatting errrs. 5. Select Save. Yu can enfrce MDM terms f use acceptance by creating a cmpliance plicy fr MDM Terms f Use Acceptance. 8
Chapter 2: Initial Cnfiguratins Cnfigure Prfile Paylads Use Mbile Device Management (MDM) functinality t enhance app perfrmance by cnfiguring a prfile paylads in a tw-step prcess. First, cnfigure general settings. Then, specify the type f restrictin r setting t apply t the device by selecting a paylad frm the list. The available paylads and their cnfigurable settings differ between platfrms. This sectin prvides a descriptin f applicable paylads and brief instructins t help yu get started. 1. Navigate t Devices > Prfiles > List View > Add and select Add Prfile. 2. Select the apprpriate platfrm fr the prfile that yu want t deply. 3. Cnfigure General settings t determine hw the prfile deplys, wh receives it, and ther verall settings. 4. Select and cnfigure a Paylad. Paylad Descriptin ios Andrid General Create a custmized prfile fr a device deplyment. Wi-Fi EAS via AirWatch Inbx Cnnect t crprate netwrks such as hidden, encrypted, r passwrd prtected netwrks using wifi prfile. Create an email prfile fr AirWatch Inbx. EAS via IBM Ntes Create an email prfile fr IBM Ntes. Webclips Publish a prfile f web clips t yur devices. Bkmarks Create a web link yur users can quickly access frm yur devices. 5. Fr step-by-step instructins n cnfiguring a specific Paylad fr a particular platfrm, please refer t the applicable Platfrm Guide. Select Save & Publish. 9
Chapter 3: Applicatin Cnfiguratin Cnfiguring AirWatch Cntainer Settings 11 10
Chapter 3: Applicatin Cnfiguratin Cnfiguring AirWatch Cntainer Settings Cnfigure default SDK Settings t define behavirs that apply t all Wrkspace ONE UEM apps. Cnfigure app specific System Settings t define unique applicatin behavir. 1. Navigate t Grups and Settings > All Settings > Apps > Cntainer. 2. Select whether t Inherit r Override the displayed settings: Inherit Use the settings f the current rganizatin grup's parent OG. Override Edit and mdify the current OG's settings directly. 3. Cnfigure the relevant settings: Setting Apple Andrid Applicatin Type Descriptin Ntificatin Select t set ios device system preferences. Select t set Andrid device system preferences. Leave the applicatin type as System r select Internal t set system preferences. System Dwnlad this app type frm an app stre. Internal Uplad this app type t the UEM cnsle. Applicatin Name Bundle ID Prvide an app name fr Internal applicatins. Navigate t Apps & Bks > Internal List Viewand scan the list fr an app name that matches the app name yu entered. This list view nly displays internal applicatins were upladed with a matching APNs certificate. Review the aut-ppulated field. This Bundle ID matches the applicatin bundle ID that was upladed internally r selected frm the drp-dwn menu. 4. Save. 11
Chapter 4: Applicatin Deplyment Cnfiguring and Deplying Applicatins 13 Managing frm the Device Dashbard 14 Managing AirWatch Cntainer Devices 14 12
Chapter 4: Applicatin Deplyment Cnfiguring and Deplying Applicatins Yu can distribute applicatins t end users autmatically nce an app is activated in the UEM cnsle r n-demand thrugh an App Catalg. Fr mre n managing apps with the App Catalg, please see the VMware Wrkspace ONE UEM Mbile Applicatin Management Guide. Refer t the Appendix fr an extensive list f capabilities by platfrm, SDK and App Wrapping. The fllwing infrmatin applies t different types f apps yu can publish: Wrkspace ONE UEM applicatins These apps include VMware Inbx, VMware Cntent Lcker and VMware Brwser. Internal applicatins Internal apps can be wrapped apps r apps that yu have integrated with the AirWatch SDK. Apps that are nt wrapped must have a Default Scheme built int the app, which is extracted and saved when the app is upladed t the UEM cnsle. Andrid end users are prmpted t install all assigned internal apps autmatically after enrllment. Fr ios devices, yu must enable the App Catalg fr applicable rganizatin grups s internal apps can be launched directly frm the AirWatch Cntainer. Nte:Irrespective f the default scheme applied r nt, the internal applicatins and public applicatins (ther that Wrkspace ONE UEM applicatins) d nt reside inside Cntainer but will be seen n the device screen and App Catalg. Public/Purchased applicatins Public apps are nly available as n-demand, recmmended apps. They are nt cnsidered cntainerized and d nt supprt SSO, branding, cnsle cmmands, r updated badges. These apps can be installed frm the AirWatch Cntainer springbard if a Default Scheme is included in the applicatin infrmatin in the UEM cnsle. If the Default Scheme is nt included in the applicatin infrmatin, the app will be available in the App Catalg. T review an applicatin's Default Scheme, navigate t Apps & Bks > List View. Frm the Actins menu, select Edit t see the applicatin infrmatin. If n default scheme ppulates in the applicatin infrmatin, then cntact the apprpriate vendr fr that infrmatin. Nte:Irrespective f the default scheme applied r nt, the internal applicatins and public applicatins (ther that Wrkspace ONE UEM applicatins) d nt reside inside Cntainer but will be seen n the device screen and App Catalg. T imprve app functinality n Andrid devices, push Wrkspace ONE UEM applicatins t enrlled devices as managed apps frm the UEM cnsle, even if the apps have already been dwnladed. Fr AirWatch Inbx n ios devices, make sure the crrect Default Scheme (awemailclient) has been entered in the UEM cnsle. 13
Chapter 4: Applicatin Deplyment Nte: The Wrkspace ONE UEM Cntainer fr ios des nt supprt the deplyment f ios applicatins purchased thrugh Apple's Vlume Purchase Prgram (VPP). Web Clips and Bkmarks Web Clips fr ios and Bkmarks fr Andrid are hyperlinks t web addresses and appear as icns n the device springbard. VMware Brwser is required t pen these links. If VMware Brwser has nt been dwnladed t the device, then the user will be prmpted t dwnlad it t pen these links. Ensure that Web Clips r Bkmarks have the Shw in the App Catalg checkbx selected in the apprpriate paylad in UEM cnsle. Managing frm the Device Dashbard Once AirWatch Cntainer is enabled and users begin t enrll their persnal devices, the UEM cnsle detects thse devices and displays the infrmatin n the Device Dashbard. Search fr specific devices in yur fleet that are AirWatch Cntainer-nly and perfrm AirWatch Cntainer-specific actins n thse devices. Imprtant: When users unenrll frm AirWatch Cntainer, they must unenrll the app befre deleting it. If AirWatch Cntainer is simply deleted, the users' devices are still tracked in the UEM cnsle. Managing AirWatch Cntainer Devices Lcate a single device frm either the Device Dashbard r by searching fr the device using the Glbal Search feature. Use the Filters t find all AirWatch Cntainer-nly devices if desired. The List View screen prvides device infrmatin. Frm here, select multiple devices r select a specific device t perfrm remte actins. Applicable remte actins are listed belw: Lck SSO End any current app sessins and prmpt user t enter their passcde again. If a user is n lnger with the rganizatin r if their device is lst r stlen, take immediate actin and lck the SSO sessin. This frces the user t enter their credentials again. Clear SSO Passcde Clear the current passcde used t sign int apps and prmpt the user t enter a new ne. Frgetting a passcde is the mst cmmn issue users face, but it is als the easiest t rectify. Use this actin t reset a user's passcde and create a new ne. Enterprise Wipe Unenrll the user frm AirWatch Cntainer and remve any applicatin data frm internal apps using the AirWatch SDK. Similar t the Device Lck feature, Enterprise Wipe can be used if a device is lst r stlen. Mre than simply ending an SSO sessin, an enterprise wipe remves all rganizatin-related cntent and features. When a device is unenrlled frm AirWatch Cntainer, all internal apps and public apps remain n the device, but the data frm the internal applicatins is deleted if theapps use the AirWatch SDK. Push Email Prfile Send a newly cnfigured r updated email prfile t the device fr access within AirWatch Cntainer. 14
Chapter 4: Applicatin Deplyment Email access is ften a user's primary need when it cmes t access n-the-g. Use the Push Email Prfile actin t send dwn new email credentials r updated credentials t ensure access is never lst. Push Ntificatins Send messages directly frm the UEM cnsle t AirWatch Cntainer. Send imprtant ntificatins t end users' devices. 15
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility Appendix: SDK Prfiles, Plicies and Settings Cmpatibility AirWatch Cntainer leverages several existing Wrkspace ONE UEM applicatins and features, each f which hsts a variety f available settings and plicies (Grups & Settings > All Settings > Apps > Settings and Plicies). These settings als extend t wrapped applicatins and applicatins built with the AirWatch SDK. The matrix belw utlines all available settings and ptins and hw each platfrm, feature and applicatin is affected. Settings and Plicies Supprted Optins fr Wrkspace ONE UEM Applicatins The fllwing matrix shws supprt fr Wrkspace ONE UEM applicatins built with the Wrkspace ONE UEM SDK. Inbx refers t Wrkspace ONE UEM Inbx, and nt VMware Bxer, which is nt built with the Wrkspace ONE UEM SDK. Yu can cnfigure similar settings fr Bxer when deplying the applicatin. UI Label ios Cntainer Frce Tken Fr App Authenticatin: Enable x x Andrid Passcde: Authenticatin Timeut Passcde: Maximum Number Of Failed Attempts Passcde: Passcde Mde Numeric Passcde: Passcde Mde Alphanumeric Passcde: Allw Simple Value Passcde: Minimum Passcde Length Passcde: Minimum Number Cmplex Characters Passcde: Maximum Passcde Age Passcde: Passcde Histry Bimetric Mde: Fingerprint x Username and Passwrd: Authenticatin Timeut Username and Passwrd: Maximum Number f Failed Attempts Single Sign On: Enable Integrated Authenticatin: Enable Kerbers x x 16
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility UI Label Cntainer ios Andrid Integrated Authenticatin: Use Enrllment Credentials Integrated Authenticatin: Use Certificate Offline Access: Enable Cmprmised Prtectin: Enable App Tunnel: Mde x App Tunnel: URLs (Dmains) x Cntent Filtering: Enable x x Gefencing: Area x x DLP: Bluetth x x DLP: Camera x x DLP: Cmpsing Email x x DLP: Cpy and Paste Out x x DLP: Cpy and Paste Int x x DLP: Data Backup x x DLP: Lcatin Services x x DLP:Printing x x DLP: Screensht x x DLP: Third Party Keybards x x DLP: Watermark x x DLP: Limit Dcuments t Open Only in Apprved Apps x x NAC: Enable x x NAC: Cellular Cnnectin x x NAC: Wi-Fi Cnnectin x x Branding: Enable Branding: Tlbar Clr Branding: Tlbar Text Clr 17
Appendix: SDK Prfiles, Plicies and Settings Cmpatibility UI Label Cntainer ios Andrid Branding: Primary Clr x x Branding: Primary Text Clr Branding: Secndary Clr x Branding: Secndary Text Clr x x Branding: Organizatin Name x x Branding: Backgrund Image iphne and iphne Retina x Branding: Backgrund Image iphne 5 (Retina) x Branding: Backgrund Image ipad and ipad (Retina) x Branding: Backgrund Small, Medium, Large, and XLarge x Lgging: Enable x x Lgging: Lgging Level x x Lgging: Send Lgs Over Wi-Fi x x Custm Settings: Enable x x SDK App Cmpliance: Enable x x Cmprmised Prtectin: Enable Offline Access: Enable * This ptin is supprted but is nt cnfigured using Settings and Plicies. ** This ptin requires Andrid Ice Cream Sandwich and KitKat. 18