After your devices are enrolled and configured, you can manage the devices using the Workspace ONE ™ UEM console. The management tools and functions enable you to keep an eye on your devices and remotely perform administrative functions.

You can manage all your devices from the UEM console. The Dashboard is a searchable, customizable view that you can use to filter and find specific devices. This feature makes it easier to perform administrative functions on a particular set of devices. The Device List View displays all the devices currently enrolled in your Workspace ONE UEM environment and their status. The Device Details page provides device-specific information such as profiles, apps, Workspace ONE Intelligent Hub version and which version of any applicable OEM service currently installed on the device. You can also perform remote actions on the device from the Device Details page that are platform-specific.

You can upload internal applications with local files to deploy them to your mobile network and take advantage of the mobile application management features of Workspace ONE UEM.

Complete the following steps to upload an internal application to the Workspace ONE UEM console, as a local file.

1. Navigate to Resources > Apps > Native > Internal and select Add Application.

2. Select Upload > ****Local File and browse for the application file on the system.

3. Click Save.

4. Select Continue and configure the Details tab options. Not every option is supported for every platform.

   Details Setting	Details Description
   Name	Enter a name for the application.
   Managed By	View the organization group (OG) that the application belongs to in your Workspace ONE UEM OG hierarchy.
   Application ID	Represents the application with a unique string. This option is pre-populated and was created with the application. Workspace ONE UEM uses the string to identify the application in systems for applications that are on allowed and denied lists.
   App Version	Displays the coded version of the application set by the application's developer.
   Build Version	Displays an alternate "File Version" for some applications.This entry ensures Workspace ONE UEM records all version numbers coded for applications because developers have two places within some applications they can code a version number.
   UEM Version	Displays the internal version of the application set by the Workspace ONE UEM console.
   Supported Processor Architecture	Select the bit-architecture value for applicable Windows applications.
   Is Beta	Tags the application as still under development and testing, a BETA version.
   Change Log	Enter notes in this text box to provide comments and notes to other admins concerning the application.
   Categories	Provide a category type in the text box to help identify how the application can help users. You can configure custom application categories or keep the application's pre-coded category.
   Minimum OS	Select the oldest OS that you want to run this application.
   Supported Models	Select all the models that you want to run this application.
   Is App Restricted to Silent Install-Android	Assigns this application to those Android devices that support the Android silent installation feature. The end user does not have to confirm installation activity when you enable this option. This feature makes it easier to uninstall many applications simultaneously. Only Android devices in the smart group that supports the silent uninstallation benefit from this option. These Android devices are also called Android enterprise devices.
   Default Scheme	Indicates the URL scheme for supported applications. The application is packaged with the scheme, so Workspace ONE UEM parses the scheme and displays the value in this field. A default scheme offers many integration features for your internal applications, including but not limited to the following options: Use the scheme to integrate with other platform and web applications, Use the scheme to receive messages from other applications and to initiate specific requests, or Use the scheme to launch Apple iOS applications in the AirWatch Container
   Description	Describe the purpose of the application.Do not use '<' + String in the Description, as you might encounter an Invalid HTML content error.
   Keywords	Enter words that might describe features or uses for the application. These entries are like tags and are specific to your organization.
   URL	Enter the URL from where you can download the application and get information about it.
   Support Email	Enter an email to receive suggestions, comments, or issues concerning the application.
   Support Phone	Enter a number to receive suggestions, comments, or issues concerning the application.
   Internal ID	Enter an identification string, if one exists, that the organization uses to catalog or manage the application.
   Copyright	Enter the publication date for the application.

   Developer Information Setting	Developer Information Description
   Developer	Enter the developer's name.
   Developer Email	Enter the developer's email so that you have a contact to whom to send suggestions and comments.
   Developer Phone	Enter a number so that you can contact the developer.

   Log Notification for App SDK Setting - iOS	Log Notification for App SDK Description - iOS
   Send Logs To Developer Email	Enable sending logs to developers for troubleshooting and forensics to improve their applications created using a software development kit.
   Logging Email Template	Select an email template uses to send logs to developers.

   Installer Package Deployment Setting - Windows Desktop MSI	Installer Package Deployment Description - Windows Desktop MSI
   Command Line Arguments	Enter command-line options that the execution system uses to install the MSI application.
   Timeout	Enter the time, in minutes, that the installer waits with no indication of installation completion before it identifies an installation failure.When the system reaches the timeout number, it stops monitoring the installation operation.
   Retry count	Enter the number of attempts the installer tries to install the application before it identifies the process as failed.
   Retry interval	Enter the time, in minutes, the installer waits between installation attempts.The maximum interval the installer waits is 10 minutes.

   Application Cost Setting	Application Cost Description
   Cost Center	Enter the business unit charged for the development of the application.
   Cost	Enter cost information for the application to help report metrics concerning your internal application development systems to the organization.
   Currency	Select the type of currency that paid for the development, or the currency that buys the application, or whatever you want to record about the application.

5. Complete the Files tab options. You must upload a provisioning profile for Apple iOS applications and you must upload the architecture application files for Windows Desktop applications. If you do not upload the architecture application files, the Windows Desktop application does not function.

   Platform	Auxiliary File	Description
   All	Application File	Contains the application software to install and run the application and is the application you uploaded at the beginning of the procedure.
   Android	Firebase Cloud Messaging (FCM) Token	This is a Workspace ONE SDK feature and does not apply to all Android applications.Some internal, Android applications support push notifications from the application to device-users.
   		- Select elect Yes for the Application Supports Push Notification option.
   		- Enter the Server API key in the FCM Token (API Key) option. Get this from the Google Developer's site.
   		A developer codes a corresponding SenderID into the internal application.
   		To use the feature, push the notification from the applicable device record in the console using the Send admin function on the Devices tab.
   Apple iOS	Provisioning Profile or APNs files for development or production	By default your application package contains the provisioning profile. However, for internal Apple iOS applications, you might have to provide a provisioning profile so that the internal application works when it is managed in Workspace ONE UEM if your application package does not contain the provisioning profile or if your provisioning profile has expired. You can obtain this file from your Apple iOS application developers.
   		A provisioning profile authorizes developers and devices to create and run Apple iOS applications. See Apple iOS Provisioning Profiles for information about Workspace ONE UEM integration with this auxiliary file. Ensure this file covers enterprise distribution and not app store distribution and that it matches the IPA file (Apple iOS application file).
   		If your application supports Apple Push Notifications Services (APNs), you can enable this file for messaging functionality. Apple Push Notification service (APNs) is the centerpiece of the remote notifications feature that lets you push small amounts of data to devices on which your app is installed, even when your app isn't running. To make use of Apple Push Notifications Services (APNs), upload either the development or production APNs certificate.
   macOS	Metadata file (pkginfo.plist)	Create this file with a third-party utility tool like Munki or AutoPkgr. You can also use the Workspace ONE Admin Assistant to make this file. The file is available in the console when you upload an internal, macOS application.
   Windows Desktop	Dependency files	Contains the application software to install and run the application for Windows Desktop.
   Windows Phone	Dependency files	Contains the application software to install and run the application for Windows Phone.

6. Complete the options on the Images tab.

   Setting	Description
   Mobile Images	Upload or drag images of the application to display in the app catalog for mobile devices.
   Tablet Images	Upload or drag images of the application to display for tablets.
   Icon	Upload or drag images to display in the app catalog as its icon.

   Note: To achieve best results for Mobile and Tablet Images, refer Apple Developer Website for iOS and Play Console Help for Android.

7. Complete the Terms of Use tab.

   Terms of use state specifically how users are expected to use the application. They also make expectations clear to end users. When the application pushes to devices, users view a terms of use page that they must accept to use the application. If users do not accept, they cannot access the application.

8. Complete the More > SDK tab.

   Setting	Description
   SDK Profile	Select the profile from the drop-down menu to apply features configured in Settings & Policies (Default) or the features configured in individual profiles configured in Profiles.
   Application Profile	Select the certificate profile from the drop-down menu so that the application and Workspace ONE UEM communicate securely.

9. Complete the More > App Wrapping tab.

   You cannot wrap an application that you previously saved in the Workspace ONE UEM console. You have two options:

   • Delete the unwrapped version of the application, upload it to Workspace ONE UEM, and wrap it on the App Wrapping tab.
   • Upload an already wrapped version of the application, if you have one, which does not require deleting the unwrapped version.

   Setting	Description
   Enable App Wrapping	Enables Workspace ONE UEM to wrap internal applications.
   App Wrapping Profile	Assign an app wrapping profile to the internal application.
   Mobile Provisioning Profile - iOS	Upload a provisioning profile for Apple iOS that authorizes developers and devices to create and run applications built for Apple iOS devices.
   Code Signing Certificate - iOS	Upload the code signing certificate to sign the wrapped application.
   Require encryption - Android	Enable this option to use Data At Rest (DAR) encryption on Android devices. Workspace ONE UEM uses the Advanced Encryption Standard, AES-256, and uses encrypted keys for encryption and decryption.
   	When you enable DAR in App Wrapping, the App Wrapping engine injects an alternative file system into the application that securely stores all the data in the application. The application uses the alternative file system to store all files in an encrypted storage section instead of storing files in disk.
   	DAR encryption helps protect data in case the device is compromised because the encrypted files created during the lifetime of the application are difficult to access by an attacker. This protection applies to any local SQLite database, because all local data is encrypted in a separate storage system.

10. Select Save & Assign to configure flexible deployment options for the application.

Adding assignments and exclusions lets you schedule multiple deployment scenarios for a single application. You can configure deployments for applications for a specific time and let the Workspace ONE UEM console carry out the deployments without further interaction. You can add a single assignment or multiple assignments to control your application deployment and prioritize the importance of the assignment by moving its place in the list up for most important or down for least important. Also, you can also exclude groups from receiving the assignment.

The flexible deployment feature resides in the Assign sections of the application area and offers advantages to the assigning process. You can also exclude groups from receiving the assignment from the Exclusions tab.

• Assign multiple deployments simultaneously.
• Order assignment so that the right distribution criteria and app policies get applied to your devices.
• Customize distribution and app policies for one or more smart groups.

1. Navigate to Resources > Apps > Native > Internal or Public.

2. Upload an application and select Save & Assign or select the application and select Assign from the actions menu.

3. On the Assignments tab, select Add Assignment and complete the following options.

   1. In the Distribution tab, enter the following information:

      Platform-specific configurations are listed separately.

      Setting	Description
      Name	Enter the assignment name.
      Description	Enter the assignment description.
      Assignment Groups	Enter a smart group name to select the groups of devices to receive the assignment.
      Deployment Begins On	Deployment Begins On is available only for internal applications.Set a day of the month and a time of day for the deployment to start.For successful deployment, consider traffic patterns of your network before you set a beginning date with bandwidth.
      App Delivery Method	On Demand – Deploys content to a catalog or other deployment agent and lets the device user decide if and when to install the content. This option is the best choice for content that is not critical to the organization. Allowing users to download the content when they want helps conserve the bandwidth and limits unnecessary traffic.Automatic – Deploys content to a catalog or other deployment Hub on a device upon enrollment. After the device enrolls, the system prompts users to install the content on their devices. This option is the best choice for content that is critical to your organization and its mobile users.

      Platform	Setting	Description
      macOS and Windows	Display in App Catalog	Select Show or Hide to display an internal or public application in the catalog. Note: The Show or Hide option is applicable only to the Workspace ONE Catalog and not legacy AirWatch Catalog. Use this feature to hide applications in the app catalog you do not want users to access.
      Windows	Application Transforms	This option is visible when your app has transform files associated. Select the transform file that must be used on the devices selected in the Distribution section. If the transform file selection is changed after the app is installed, the update does not get applied on the devices. Only the newly added devices which do not have the app installed receives the updated transform.

   2. In the Restrictions tab, enter the following information:

      Platform	Setting	Description
      Android and iOS	EMM Managed Access	Enable adaptive management to set Workspace ONE UEM to manage the device so that the device can access the application.Workspace ONE controls this feature and not AirWatch Catalog.Only the devices that are enrolled in EMM are allowed to install the app and receive app policies when you enable this setting. Note The setting only impacts Workspace ONE Intelligent Hub users not the legacy AirWatch Catalog users.
      iOS	Remove on Unenroll	Set the removal of the application from a device when the device unenrolls from Workspace ONE UEM.If you choose to enable this option, supervised devices are restricted from the silent app installation.If you choose to disable this option, provisioning profiles are not pushed with the installed application. That is, if the provisioning profile is updated, the new provisioning profile is not automatically deployed to devices. In such cases, a new version of the application with the new provisioning profile is required.
      iOS	Prevent Application Backup	Prevent backing up the application data to iCloud.
      iOS	Prevent Removal	If you enable this setting, the user is prevented from uninstalling the app. This is supported in iOS 14 and later.
      iOS and Windows	Make App MDM Managed if User Installed	Assume management of applications previously installed by users on their iOS devices (supervised and unsupervised) and Windows Desktop. MDM management occurs automatically regardless of the application delivery method and requires privacy settings to allow the collection of personal applications. For unsupervised iOS devices, the apps get converted to MDM managed only upon the user’s approval.Enable this feature so that users do not have to delete the application version installed on the device. Workspace ONE UEM manages the application without having to install the application catalog version on the device.

   3. In the Tunnel tab, enter the following information:

      Platform	Setting	Description
      Android	Android	Select the Per-App VPN Profile you like to use for the application and configure a VPN at the application level.
      Android	Android Legacy	Select the Per-App VPN Profile you like to use for the application and configure a VPN at the application level.
      iOS	Per-App VPN Profile	Select the Per-App VPN Profile you like to use for the application.
      iOS	Other Attributes	App attributes provide device-specific details for apps to use. For example, when you want to set a list of domains that are associated to a distinct organization.

   4. In the Application Configuration tab, enter the following information:

      Setting	Description
      Android	Send application configurations to devices.
      iOS	Upload XML (Apple iOS) – Select this option to upload an XML file for your iOS applications that automatically populates the key-value pairs. Get the configurations supported by an application from the developer in XML format.

      Note: You might see additional configuration tabs while configuring productivity apps. For example, if you are configuring a Workspace ONE Notebook application, Account Settings and App policies are displayed. For more information, go to the productivity app documentation.

4. Select Create.

5. Select Add Assignment to add new app assignments for your application.

6. Configure flexible deployment settings for your application by editing the schedules and priority for your deployments. Options that are displayed on this window are platform-specific.

   Setting	Description
   Copy	From the ellipses-vertical, you can click copy if you choose to duplicate the assignment configurations.
   Delete	From the ellipses-vertical, you can delete to remove the selected assignment from the application deployment.
   Priority	You can modify the priority of the assignment you configured from the drop-down menu while placing the selected assignment in the list of assignments. Priority 0 is the most important assignment and takes precedence over all other deployments. Your devices receive all the restrictions distribution policies and the app configuration policies from the assignment group which has the highest priority.
   	If a device belongs to more than one smart group and you assign these smart groups to an application with several flexible deployments, the device receives the scheduled flexible deployment with the most immediate Priority. As you assign smart groups to flexible deployments, remember that a single device can belong to more than one smart group. In turn, one device can be assigned to more than one flexible deployment for the same application.
   	For example, if Device 01 belongs to Smart Group HR and Smart Group Training. You configure and assign two flexible deployments for application X, which include both Smart Groups. Device 01 now has two assignments for application X.
   	- Priority 0 = Smart Group HR, to deploy in 10 days with On Demand.
   	- Priority 1 = Smart Group Training, to deploy now with Auto.
   	Device 01 receives the priority 0 assignment and gets the application in 10 days because of the assignments priority rating. Device 01 does not receive the priority 1 assignment.
   Assignment Name	View the assignment name.
   Description	View the assignment description.
   Smart Groups	View the assigned smart group.
   App Delivery Method	View how the application pushes to devices. Auto pushes immediately through the AirWatch Catalog with no user interaction. On Demand pushes to devices when the user initiates an installation from a catalog.
   EMM Managed Access	View whether the application has adaptive management enabled. When you enable this setting, the end-user is allowed to access the applications using Workspace ONE SDK only when it is EMM managed. To avoid any disruption to the service, ensure to take over management if the 'user installed' flag is enabled.

7. Select the Exclusions tab and enter smart groups, organization groups, and user groups to exclude from receiving this application.

   • The system applies exclusions from application assignments at the application level.
   • Consider the organization group (OG) hierarchy when adding exclusions. Exclusions at a parent OG do not apply to the devices at the child OG. Exclusions at a child OG do not apply to the devices at the parent OG. Add exclusions at the desired OG.

8. Select Save & Publish.

This matrix summarizes specific functionality and configurations, as available by OEM.

Note: System updates for Google Glass devices are handled by an OTA server. Please contact Google for more information.