The Multi User feature has made large changes in how an admin will manage their devices going forward. By using the new Modern Stack architecture, Workspace ONE will be able to manage devices with multiple users. Whoever is logged into Windows Desktop will become the device's enrolled user. We will then track the enrolled user for everyone who signs in. It is very important that the device resources are assigned to the device.
Multi User is now the default enrollment method for Workspace ONE managed Windows devices. Starting in UEM 2406 and Intelligent Hub 2404 all devices will be Multi User enabled by default. This change will create new use cases including shift-based work and the ability to reassign devices without an enterprise wipe. There are no additional command line switches or arguments that need to be passed to enable the Multi User feature.
Enrollment
There are five types of enrollment options and some have additional requirements.
-
Out of Box Enrollment: Devices enrolled using Autopilot are supported. However, the Intelligent Hub must be installed in order to enable the Multi User feature. In your System Settings > Devices & Users > Microsoft > Windows, ensure that the Publish Intelligent Hub option is selected.
-
Command Line Enrollment: For Multi User Mode, all devices will be Multi User enabled by default with no additional command line switch needed.
-
Agent Enrollment: Agent Based enrollment is supported. No additional configuration is required to enable Multi User during Agent enrollment.
-
Enrollment with Dropship Provisioning (Online and Offline): Supports Multi User Mode with no additional configuration is required.
-
Staging Enrollment Flows: Standard Single User Staging is supported with no additional configuration needed. Advanced Single User or Multi User Staging is not supported. To verify your staging user settings, navagate to: the user details > Advanced > Staging.
Note: Any user can now become a Staging User. Administrators are no longer required to pre-configure a user to be a dedicated Staging User. If the common resources are created in the device context and the assignments are configured for all users of the device, resources will not be re-installed.
A feature was added in 2506 that gives the admin the ability to select the type of User Mode to use for a new enrollment. The default for the User Mode is set to Multi User, but you can now select Single User enrollment from here if you need. This can also be configured per organization group (OG). You can find this in the console under: System > Devices & Users > Microsoft > Windows > Intelligent Hub Settings > Default User Mode for Enrollment.
For more enrollment information refer to: [Workspace ONE UEM Windows Multi User on TechZone](https://techzone.omnissa.com/resource/workspace-one-uem-windows-Multi User#device-enrollment).
Shared Device Settings
The default setting is to prompt user for their organization group (OG). If this setting is not changed, the user will be prompted to enter the Organization Group ID. It is recommended to change this setting to Fixed Organization Group or User Group Organization Group so that user reassignment is silent. For Fixed Organization Group, the device will then remain in the current Organization Group while the User Group Organization will move the device to the configured Organization Group. The Group Assignment Mode is under System Settings > Devices and Users > General > Shared Device. From there, you can control how to map a device to the right Organization Group.
Console View
Devices show their current user mode (Multi User, Single User) in multiple areas within the console.
-
Multi User Mode: The enrolled user of the device will be updated based on the current logged in Windows user.
-
Single User Mode: The enrolled user will always be the user who is enrolled on the device. The enrolled user will not be updated if another user signs into Windows.
Device List & Details Page
The Device List custom view shows the User Mode column which displays the current mode. The Device Details view also displays the current User Mode in the Device Info Panel.
Filters
On the Device List View Page, filters have been added to aid in multiple administrative scenarios:
-
Single User (legacy): Devices enrolled as a Single User device due to an old Intelligent Hub version that does not support Multi User.
-
Multi User: Devices enrolled or migrated to Multi User Mode.
-
Multi User Capable: Devices that are currently enrolled as Single User (legacy) but are available to migrated. These devices meet the requirement to migrate to Multi User including the correct Intelligent Hub version. Use this filter when migrating existing Single User (legacy) devices to Multi User.
-
Single User: Multi User devices that currently have their user reassignment functionality paused. The enrollment user will not be updated on these devices when a new user signs into Windows. User Reassignment can be paused (or unpaused) on both the device list view or device details page.
Directory Services Support
Multi User has introduced support for the following directory type configurations:
- LDAP Active Directory is supported
- LDAP Lotus Domino is NOT supported
- LDAP Novell e-Directory is NOT supported
- LDAP Other is supported
- Omnissa Identity Services is supported
- None is supported
Attributes for Unique Identifier
To identify who is currently logged in and match them to a user object in the UEM console, it is necessary to set up the attributes used for the matching. In the Windows Intelligent Hub settings, administrators should pick the appropriate pair from the possible UEM User Attributes and the four attributes that the Intelligent Hub can gather from the device. The recommendation is to use UPN / UPN for most use cases. Under the Attributes for Unique Identifier, select the UEM User Attribute that aligns with the desired Client User Attribute as shown below.
| UEM User Attributes | Client User Attributes |
|---|---|
| Object Identifier | Object GUID (requires line of sight to Domain Controler) |
| Username | Sam Account Name |
| Recommended: User Principal Name | User Principal Name |
| EmployeeID | User SID |
| Email Address | |
| Custom Attribute 1-5 |
By default, the unique identifier is set to Object Identifier / Object GUID. We highly recommend changing this based on your environment needs. Be aware that Object GUID requires an active connection to the Domain Controller to get the GUID on the device. To configure go to: Settings > Device Settings > Devices & Users > Microsoft > Windows > Intelligent Hub Settings.
Migration
Starting in 2406, all newly enrolled Windows Desktop devices will be Multi User enabled by default. Existing enrolled Windows Desktop devices will remain as Single User (Legacy) devices. Administrators will be required to migrate their previously enrolled devices to Multi User. The reason for this is to allow administrators to validate their resource assignments prior to Multi User enablement. This will ensure that if the enrollment user is updated after migration, no resources are inadvertently removed.
Example: A device was enrolled by an IT team member using command line staging. During this set up, the team member signed into the device to complete some additional configuration and inadvertently enrolled the device to themselves. The device is then handed off to the actual end user. Upon migration to Multi User, this device's enrollment user will be changed to the actual end user. If the resource assignments are not assigned to actual end user, they would be removed upon migration. See Resource Assignments section for more information on how to properly configure common resources for use in a Multi User scenario.
Migration to Multi User
Migrating devices that were previously enrolled can be done in a few different ways:
-
Device List View: In the Device List view, select one or more devices via the checkbox and select Change to Multi User Mode. To identify which devices are capable of being migrated, leverage the "Multi User Capable" filter in Filters section of the Device List View page. This filter will list all devices that are capable of being migrated (currently Single User and meet the minimum Intelligent Hub requirements to support Multi User). Administrators will then be presented with the following acceptance screen. Click Proceed.
Note: The Device List View is limited to selecting 100 devices at a time. To migrate more than 100 devices at a time, it is recommended to leverage the API method.
-
Migration via API: The migration can be triggered with the following POST URL:
https://%APISERVERUL%/api/mdm/devices/action/with the following body:
{
"action_name": "MIGRATE_TO_Multi User",
"filter":
{
"organization_group_uuid": "999362E5-7D35-487B-A74F-7C0A377BB521", "device_uuids": [
"338234E5-F1DE-46CF-AE1C-DFFD919CFE32",
"40D18DF3-0B04-4648-A26A-E5D24F2CD4D9"
]
} }
Important
Please make sure to select the version 3 of the API. This data needs to be added to the API header like in this example:
"Accept", "application/json; version=3"
The following actions are available:
-
MIGRATE_TO_Multi User -- For migrating devices from Multi User Capable to Multi User device
-
CHANGE_TO_SINGLEUSER -- To change a Multi User Device to a Single User Device
-
CHANGE_TO_Multi User -- To change a Single User Device to a Multi User Device
End User Experience when Switching Users:
Multi User was designed to be as seamless to the end user as possible. To re-assign the device to a new user, simply sign out of Windows and sign in with a different corporate User.
On Domain Joined devices (Active Directory, Hybrid Join, or AAD), the user reassignment will be performed silently. To confirm that re-assignment was successful, the end user will see the following Windows notification after login. This notification will only be shown once after user switch.
On Workgroup Joined devices, Workspace ONE is unable to lookup the required attributes needed to silently re-assign the device. On those devices, the Intelligent Hub will prompt the end user to authenticate using their corporate credentials. After entering their credential successfully, the user will see the notification indicating their user is now connected to Workspace ONE and the device has been properly re-assigned.
-
Failed User Re-Assignment: When a new User signs in to a Domain Joined machine, Workspace ONE will silently attempt to check out the device. If the first attempt fails, Workspace will wait two minutes before trying again. This will repeat three times. In the event Workspace ONE was unable to silently checkout the device, the Intelligent Hub will then prompt the user to enter their credentials. Upon entering their credentials, the device will then be re-assigned.
-
Sign out vs. Switch User: To perform the user re-assignment, it is required for the current user to sign out of Windows. Performing a User Switch is not supported. It is recommended to leverage a CSP or GPO to block User Switching on devices that will be frequently switching users. For more information on CSP, refer to Microsoft at: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-cspwindowslogon
| Assignment | User A | User B |
|---|---|---|
| System Context application - Assigned to Device | Application will stay on the device | Application will stay on the device |
| System Context application - Assigned to User A | Application will stay on the device | Application gets removed |
| System Context application - Assigned to User B | Application gets removed | Application will stay on the device |
| System Context application - Assigned to User A and B | Application will stay on the device | Application will stay on the device |
| User Context application - Assigned to User A | Application will stay on the device | Application will stay on the device |
| User Context application - Assigned to User B | Application will stay on the device | Application will stay on the device |
| User Context application - Assigned to User A and B | Application will stay on the device | Application will stay on the device |
Profile Context
Profile context works similarly in that device level configurations. They are installed using Device Profiles and affect all users on a device. A few examples of this are the encryption of the device, and/or general DLP settings. User profiles are then used to install user specific resources like identity certificates or customizations.
Assignment Groups
Workspace ONE leverages Assignment Groups to assign resources to devices. If a user does not have an assignment to a resource, that resource will be uninstalled. It is crucial that all users be assigned to common resources on a shared workstation. For example: An application that will be used by all users. For all required resources, check the assignment groups used. If you leverage User Groups make sure they include all users or if you use Smart Groups check if the user groups are part of the criteria and if any user exclusions are applied.
Workflows
Workflows, with all included resources, are fully supported on Multi User devices. The behavior of assigned Workflows is different than Profiles or Applications. Workflows will be re-executed and reevaluated with every user switch. This ensures that user context resources are applied to the current enrollment user. Applications and Profiles that are already installed on the device will not be re-installed since the UEM detection will check the installation status before.
Certificates
User and Device certificates can be used on a Multi User device. Assigned Device Certificates are available for all users, while User Certificates are only available for the current enrollment user. If a user logs in the first time to the device, the User Certificate(s) will be requested and installed for the enrollment user. If the user logs in to the device again, the certificate is already installed and there will be no new request on the CA generated.
Prevent User Reassignment
There are two ways in the UEM Consol to prevent or block user reassignments.
Checkout Restrictions: If there is a need to block a specific group from checking out devices to their user account, there is the following configuration available:
-
All members of the user group(s) that are added in the “Windows Multi User Checkout Restrictions” section, will not be able to change the enrollment user on a device. This setting can be configured per OG and will be inherited to all child OG’s – if the “Override” option is not selected in a child OG.
For example: User A is logged in to the device and a help desk employee logs in to the device. The device should stay assigned to User A. In this case the account of the help desk employee can be added to a user group and configured in the checkout restrictions. The help desk employee will not change the enrollment user on any device in this OG anymore.
User Accounts that are configured for the Checkout Restrictions are still able to enroll devices, but they cannot change the user on an already enrolled device. This does not apply to staging flows - a staging flow device can't be changed to a user in the checkout restrictions group.
Switch from Multi User Mode to Single User Mode: If there is a need to temporary or permanently pause/stop the user reassignment, one or multiple devices can be selected in the console to switch from Multi User Mode to Single User Mode. If the the device is in Single User Mode, the enrollment user will not change to any new logged in users. This can also be used for Single User devices if they might be enabled to use Multi User capabilities in the future without re-enrollment of the device. After the device switched back to Multi User Mode, every user change will change the enrollment user of the device. Next, Pause and Resume via API.
Was this page helpful?