Getting Started with Workspace ONE XR Hub

Omnissa Workspace ONE XR Hub is a companion to Omnissa Workspace ONE Intelligent Hub that provides an enterprise experience and cross-platform native launcher for Virtual Reality (VR) devices. XR hub provides secure and simple access to corporate applications and content on a wide variety of standalone eXtended Reality (XR) devices.

XR Hub works with Workspace ONE UEM to provide secure access to native VR and remote XR applications and shared device check-in/check-out functionality. XR Hub can also be used with Workspace ONE Access to provide advanced authentication and unified application catalog purposes.

Client Components

• Omnissa Workspace ONE Intelligent Hub (Intelligent Hub)
  • Provides enterprise device management capabilities.
  • Supports a wide range of smartglasses and augmented, virtual, and mixed reality devices.
• Workspace ONE XR Hub (XR Hub)
  • Provides a more secure enterprise device experience.
  • Supports Android based Virtual Reality (VR) devices.

Cloud/Server Components

Workspace ONE UEM combined with Workspace ONE Access (optional) provides the best approach enabling your XR device fleet.

• Workspace ONE UEM (UEM)
  • Manages and secures XR devices for enterprise deployment.
• Workspace ONE Access (Access), although optional, enables
  • Authentication with Active Directory and 3rd Party Identity Providers.
  • Automated unified catalog including applications published using Access, UEM, and Omnissa Horizon.

Software Requirements

• See the XR Hub Omnissa Interoperability Matrix for the current list of supported software versions.
• Workspace ONE UEM 2212+
• Workspace ONE Intelligent Hub client - download (airwatchagent.apk) available from (https://getwsone.com)
• Workspace ONE XR Hub client v23.04+ - download available from (https://my.workspaceone.com/products/Workspace-ONE-XR-Hub)

Software Options

• See the XR Hub Omnissa Interoperability Matrix for the current list of supported software versions.
• Workspace ONE Access for Unified Catalog and advanced authentication options such as Single sign-on (SSO) and Multi Factor Authentication (MFA)
• Workspace ONE Tunnel for Mobile SSO into third party applications.
• NVIDIA CloudXR v3.1+ for remote rendering / VR app streaming.
• Omnissa Unified Access Gateway (UAG) with Workspace ONE Tunnel for Per App VPN.
• Omnissa Horizon for VDI access (Tech Preview) or scaling a remote rendering solution (Tech Preview).
• XR Hub Cloud Link for Horizon/CloudXR integration (Tech Preview).

Supported Hardware

See the XR Hub Device Interoperability Matrix for the current list of supported devices.

The following XR devices are compatible with Workspace ONE XR Hub.

• HTC VIVE XR Elite™ (with the latest firmware)
• HTC VIVE Focus 3™ (firmware version 3.0.999.456 or later)
• Meta Quest 3™ (firmware version 72 or later)
• Meta Quest 3S (firmware version 72 or later)
• Meta Quest Pro™ (firmware version 72 or later)
• Meta Quest 2™ (firmware version 72 or later)
  • Meta devices must be enrolled to Workspace ONE UEM via Meta Horizon Managed Services
  • Kiosk Mode via Meta Shared Mode requires OS v74+, Meta Shared Mode 20.0.0.0.84+, and OEMConfig.APK 74.0.0.0.490+
• PICO 4 Enterprise™ (with PUI version 5.0 or later)
• PICO Neo 3™ / PICO Neo 3 Pro Eye™ (with PUI version 4.3.34 or later)

Note: When enrolling a device using Workspace ONE Intelligent Hub, Device Owner admin rights are granted as part of the enrollment process. If this device is later unenrolled from Workspace ONE UEM, a factory reset is automatically performed as part of the unenrollment process, erasing all files and content from the device.

Workspace ONE XR Hub Deployment Options

Before configuring XR Hub, you should understand the different deployment options available.

Recommended: Device Management with Secure Launcher and Unified App Catalog

• Products: XR Hub, Intelligent Hub client, Workspace ONE UEM, Workspace ONE Access.
• VR devices are managed with Workspace ONE UEM and Intelligent Hub client.
• XR Hub is deployed using UEM to managed devices to provide an enterprise experience.
• XR Hub is integrated with Workspace ONE Access for conditional access, SSO, and advanced authentication flows (MFA).
• XR Hub is integrated with UEM and Access for Shared Device functionality.
• XR Hub automatically presents a unified application catalog based on entitlements across UEM, Access, and optionally Omnissa Horizon.

Minimum: Device Management with Secure Launcher

• Products: XR Hub, Intelligent Hub client, Workspace ONE UEM.
• VR devices are managed with Workspace ONE UEM and Intelligent Hub client.
• XR Hub is deployed using Workspace ONE UEM to managed devices to provide an enterprise experience.
• XR Hub is integrated with UEM for Shared Device functionality.
• XR Hub presents application catalog manually defined by administrator in XR Hub configuration.

VR Streaming: Device Management with Secure Launcher, Unified App Catalog, and VR Streaming

• Products: XR Hub, Intelligent Hub client, XR Hub Cloud Link (optional, Tech Preview), Workspace ONE UEM, Workspace ONE Access, NVIDIA CloudXR, and Omnissa Horizon (optional, Tech Preview).
• Same as recommended deployment plus:
  • Workspace ONE Access is used to publish Remote XR applications to XR Hub.
  • NVIDIA CloudXR Server binary is installed on remote VR host machine (PC/VM).
  • NVIDIA CloudXR Client is pushed to client device using UEM.
  • Tech Preview - Omnissa Horizon with XR Hub Cloud Link for orchestration and SSO.

Enroll VR Devices with Workspace ONE UEM

Managing VR devices with Workspace ONE UEM allows you to remotely control, secure, manage, and support devices. XR Hub must be remotely installed on VR devices managed by UEM. UEM provides additional functionality to XR Hub such as shared device check in / check out, Single Sign-On and remote configuration.

To manage VR devices with UEM, the device must be "enrolled" first. UEM supports manual, scripted, and QR code enrollment for VR device setup and management.

For details on setting up VR devices with Workspace ONE UEM, see https://techzone.omnissa.com/resource/extended-reality-xr-device-management-augmented-virtual-and-mixed-reality-workspace-one.

Once a device is enrolled into Workspace ONE UEM, XR Hub can be deployed and used on that VR device.

Configure Workspace ONE XR Hub

You must use Workspace ONE UEM to configure and deploy XR Hub. XR Hub must be uploaded as an application to UEM before configuration can take place. It is recommended as a best practice to have a separate organization group (OG) per device vendor. Take the following steps per device vendor (HTC, Meta, PICO).

1. Visit Omnissa Customer Connect and download the XR Hub file that correspond to your VR device vendor.

2. In Workspace ONE UEM, move to the parent organization group (OG) that manages the particular VR headset.

3. Navigate to Resources > Apps > Native and then select the Internal tab.

4. Select the Add button followed by Application File. The Add Application screen displays.

5. Select the Upload button to upload the hosted APK file you downloaded in step 1. The Add screen displays. Select the Choose File button and locate the APK file on your system. Once the APK file completes uploading, you are returned to the Add Application screen.

6. Select the Continue button on the Add Application screen. The Add Application - XR Hub v xx.xx screen displays. The uploaded APK prepopulates all the required fields so you can accept the default values or make customization per your preferences.

   

7. Select the More tab followed by SDK.

8. For SDK Profile, select Android Default Settings.

9. Select the Save & Assign button. The XR Hub - Assignment screen displays.

10. In the Distribution tab, enter the following information.

    

    Setting	Description
    Name	Enter an assignment name for the deployment assignment.
    Description	Enter the assignment description.
    Assignment Groups	Enter the smart group name(s) for your VR headsets.
    Deployment Begins On	For a typical as-soon-as-enrolled deployment use the default value.
    App Delivery Method	For a typical as-soon-as-enrolled deployment choose Automatic.

11. Move to the Restrictions tab, and enable the Managed Access slider.

12. Move to the Tunnel tab and accept the default selections.

13. Move to the Application Configuration tab and enable the Send Configuration slider. The Application Configuration screen displays with its full complement of options. Enter the following information.

    

    Note about configuring URLs in this section Most options here accepting URLs can instead accept a file based URL that references a file stored locally on the device rather than a web hosted file. The format used must be file:///storage/emulated/0/[path and fileame] for example file:///storage/emulated/0/ws1/company_logo.jpg. Based on the version of Android OS used by the device, there might be limitations on file system access.

    Setting	Description
    Workspace ONE Access URL	If you are using Workspace ONE Access for user authentication, then THIS URL MUST BE SET TO THE WORKSPACE ONE ACCESS SERVER FQDN (not the Workspace ONE UEM server). Optionally, the end user can enter another URL from within the client at any time by using the Change Workspace One Domain button at the bottom of the login window. Example: https://myws1.workspaceair.com If you are using Workspace ONE Access and this option is not configured, the user is prompted for the URL (not a recommended user experience).
    Entitlement Refresh (mins)	Standard Setting Workspace ONE Access entitlements are refreshed manually with the refresh button within the XR Hub Client (top right) and also automatically refreshed with a timed interval. By default, this interval is set to 8 hours (480 minutes) but can be altered using the "entitlementsRefreshMinutes" setting. Omnissa recommends to leave this interval set to the default value.
    Enable Kiosk Mode (Meta Quest/PICO)	Standard Setting If you are using a Meta Quest or a PICO device, set this value to enable so that XR Hub launches on device startup. Refer to Kiosk Mode for Meta Quest or Kiosk Mode for PICO for required steps to enable Kiosk Mode.
    Kiosk Mode Admin Code (Meta Quest/PICO)	Standard Setting Set a PIN code that an administrator must enter in order to exit Kiosk Mode.
    Device Tutorial Package	Advanced Setting XR Hub's user menu includes an option to launch the default device tutorial application (if one exists). This setting enables admins to set a custom application to run instead. This is primarily used to set the Meta Quest tutorial application, for example, com.oculus.MontereySetup/com.epicgames.ue4.GameActivity. Note: The custom device tutorial setting may require admins to specify the application bundle ID and the applicaton activity.
    Tutorial Video URL	Standard Setting Enter the URL of an mp4 video to display first launch of XR Hub and subsequent launches after a user has logged out. If this is left blank, no video is shown.
    Allow Skip Tutorial	Standard Setting If you are pushing a custom video tutorial to the device to be displayed in XR Hub, you can set this to enable to allow the user to skip the tutorial on first use. Setting it to disable prevents the user from logging in until the video has finished playing.
    Force Set Custom Device PIN	Standard Setting Force the user to set a custom device PIN when XR Hub first loads.
    Allow Custom Device PIN Lock From Menu	Standard Setting Allow a user to lock their device using their custom PIN from the user menu.
    Custom Device PIN Lock On Awake	Standard Setting Prompt for the set custom PIN code when the device wakes from sleep.
    Enable Device Casting	Standard Setting (PICO only)If you have users that wish to use device casting, you can set this to enable allowing the user to access device casting from XR Hub. Setting it to disable prevents the user from accessing device casting from XR Hub.
    Passthrough Activated On Load	Standard Setting XR Hub supports mixed reality use cases and can be configured to start with passthrough mode turned on. You can set this to enable to start XR Hub in passthrough mode. Setting it to disable starts XR Hub with an XR environment loaded.
    Config Entitlements Only	THIS OPTION MUST BE ENABLED ONLY WHEN WORKSPACE ONE ACCESS IS NOT USED to specify that the app catalog is defined with client configured entitlements only. This prevents XR Hub from attempting to authenticate with Workspace ONE Access. Shared devices managed by UEM still prompt users to check out a device with username and password if the device is checked in and clientConfigEntitlementsOnly is set to enable. In summary, Enable this option when you are NOT using Workspace ONE Access. Disable this option when you ARE using Workspace ONE Access.
    Show All Installed Applications	Standard Setting Enable this to show all launchable applications that are installed on the device under the Immersive Apps filter. Note: Some apps, including Intelligent Hub, Tunnel, and XR Hub are automatically filtered out.
    Ignore Shared Device Checkout	Standard Setting If you have enrolled a device as a shared device but do not want users to checkout the device, set this to enable. This is only relevant to deployments where devices maybe pre-enrolled as shared devices and then moved automatically to another user account.
    Loading Screen Custom Logo URL	Standard Setting The URL of a logo (image) to display above the spinner animation on the XR Hub loading screen. If this is left blank, no logo is displayed.
    Intro Web Page URL	Standard Setting The URL of a webpage to display after XR Hub as loaded. If this is blank, no web page is shown.
    Application Window Logo URL	Standard Setting The URL of a logo (image) to display at the top of the XR Hub application screen. If this is left blank, the logo from the console branding is used.
    Custom Credential Configuration	Advanced Setting XR Hub can be configured to pass a username or email address to a native application that is launched by XR Hub. This is only required if not using Workspace ONE Access for SSO. Click on Configure. The Custom Credential field settings: Enable Custom Credential – if set to Enable, data passes to any native application launched by XR Hub. Is In Extras Key – If set to Enable, the username passes to the application within the 'extras' dictionary of the launch intent, otherwise it passes as the 'data' parameter with no key. Extras Key - "credential" - if Is In Extras Key is Enable, then this value is the 'key' in the 'extras' dictionary containing the username. URL Encoded – If set to enable, the URL encodes the credential. Include Group – If set to enable and not using Use Logged In User, then UEM passes back the 'username' as 'group.user'; in some cases (like constructing an email address) the group is not needed (set to disable). Scheme: "creds://" – Prepend credential with a custom scheme if required (for example 'creds://'). Domain: "acme.com" – Append a domain at the end of the credential (for example 'Omnissa.com' adds '@Omnissa.com' to the end). Use Logged In User - If set to enable, the username used is the one used to either login to XR Hub or checkout the device with XR Hub. If set to disable, the username used is the one the device enrolled with. For shared devices, the shared device account (not the checked out user) is returned, if set to disable.
    Enable SSO	Standard Setting Setting Enable SSO to enable enables SSO. You can stop (Workspace ONE Access) single sign-on to XR Hub by setting this to disable.
    Authorization Profile	Standard Setting If you are managing shared devices and the check out process requires Multi-Factor Authentication (MFA), then set this to MFA. If your check out authentication flow only requires username and password, then set this to SFA for Single Factor Authentication.
    Login Username Cache	Standard Setting If users are required to authenticate, for instance, enter their username and password because you are not using SSO or PIN/passcode, then you can allow them to cache their username in the XR Hub login UI. Setting this to a value other than None provides the user with a Remember Me checkbox. If they select that checkbox, their username is cached in the XR Hub login UI until the device is checked in or reset.
    Login Username Cache Javascript Override	Advanced Setting The username field on the login form populates by taking the cached username string and injecting it into the webpage using a javascript call. There might also be a different login form with different markup, meaning this javascript execution would simply fail. A workaround for cases like this is to set the UEM profile option of Login Username Cache Javascript Override field, which allows for a custom javascript command to be entered that is substituted at runtime. For example, the override is used in the following call: WebTexture.WebView.ExecuteJavaScript(string.Format(<<<Custom Javascript Override>>>, username));
    XR Environment Theme	Advanced Setting Select the environment background you wish to present in XR Hub. For more information, see Customize XR Hub User Experience.
    XR Environment Type	Advanced Setting Select a type: Default - 360 cubemaps for 3DoF devices and 3D environment for 6DoF devices. 2D / Cubemap - To force a 360 cubemap. The cubemap must be called custom_skybox.png and installed on the device. For more information, see Customize XR Hub User Experience. 3D Environment - To force a 3D environment.
    XR Environment Custom Skybox URL	Advanced Setting Set to asset url, to override skybox when using Default Office with Custom Logo theme. See Customize XR Hub User Experience.
    XR Environment Custom Models	Advanced Setting Configure a custom 3D environment or custom 3D logo for XR Hub. The environment theme must be set to Default Office with Custom Logo theme or a custom environment theme. Only one environment model (for a custom environment theme) or one logo model (for the Default Office with Custom Logo theme) can be set. Click on Configure to configure the model. For more information, see Customize XR Hub User Experience.
    XR Environment Custom Artwork	Advanced Setting Specify the URLs for the Top, Left, and Right artwork to show on the back wall when using the Default Office with Custom Logo theme. See Customize XR Hub User Experience.
    Workspace ONE Intelligence	Advanced Setting Add the Workspsace ONE Intelligence App ID you have created for XR Hub and the level of logging you desire. See the section Setting Up XR Hub with Workspace ONE Intelligence for Analytics The Workspace ONE Intelligence SDK Settings are: Enable SDK – if set to Enable, data is sent to Workspace ONE Intelligence. Workspace ONE Intelligence App ID – Enter your XR Hub Intelligence App ID, generated from Workspace ONE Intelligence. See the section Setting Up XR Hub with Workspace ONE Intelligence for Analytics Logging Level – Set the desired logging level. SDK Region – Set this to the region for your Workspace ONE Intelligence instance.
    Applications	Standard Setting You can manually define native, web, WebXR, and remote XR applications to appear in the XR Hub application window. If not using Workspace ONE Access, applications must be defined here to appear in the XR Hub application window. Click Configure to add applications. The Application field settings are: Application Type – Choose from: Native - An application that is installed on the device and runs locally on the device. Use this if you are not using Workspace ONE Access or there are applications on the device that have not been pushed by Workspace ONE UEM. Web/SaaS - A web site/application launched in the XR Hub in-app browser. Use this method if you are not using Workspace ONE Access. Otherwise, publish Web / SaaS applications using Workspace ONE Access. WebXR - A WebXR application that is launched in the WebXR browser configured with XR Hub. Use this method if you are not using Workspace ONE Access. Otherwise, publish WebXR applications using Workspace ONE Access. See the section Publish WebXR Applications to XR Hub. Remote XR - A SteamVR/CloudXR application running on a remote Windows machine. Use this method if you are not using Workspace ONE Access. Otherwise, publish CloudXR desktop applications using Workspace ONE Access. See the section Publishing remote hosted AR/VR applications using Workspace ONE Access. Application Name – This is required for all applications and is the application name you wish to appear in the XR Hub application window. BundleID - The Android bundle ID for a native application installed on the device for example com.company.application. URL – This is required for Web / SaaS and WebXR application URLs. IP Address – This is required for Remote XR applications and is the IP address of the Windows machine hosting the CloudXR application. This machine should be actively running SteamVR with the CloudXR runtime.
    CloudXR Windows Client Path	Advanced Setting Not applicable for the current version of XR Hub.
    CloudXR Android Client Bundle ID	Advanced Setting If accessing CloudXR applications with Omnissa Horizon, Workspace ONE Access, or manually defined Remote XR applications, then define the bundle ID of the CloudXR client you push to the XR device. For example, com.nvidia.cloudxr.ovr.
    Entitlement Filters	Standard Setting Using entitlement filters you can hide or ensure applications are shown first in the XR Hub application window. Click Configure to add entitlement filters. The Entitlement Filter settings are: Entitlement Type - Choose from: Hidden - Hides the specified application from showing in the XR Hub application window. Useful for hiding a WebXR browser application, 2D applications or other non-user applications pushed to devices. Type Priority - These applications show first and on every page for their specific application type (Immersive, Browser, Horizon) Global Priority - These application show first and on every page despite the type of application chosen (Immersive, Browser, Horizon) Application Name – The name of the application, as displayed in the XR Hub application window.
    Firmware Updates	Not currently supported with this version of XR Hub.
    Max Window Drag Height	Advanced Setting Use this to specify how high a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    Min Window Push Distance	Advanced Setting Use this to specify how close a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    Max Window Push Distance	Advanced Setting Use this to specify how far away a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    StyleSheet URLs	Advanced Setting Specify the URL of the StyleSheet used to configure the color scheme of XR Hub. See Customize XR Hub User Experience.
    WebXR Browser Configuration	Advanced Setting This setting enables you to define what WebXR browser or package should be used to launch WebXR applications from XR Hub. It should be noted that any browser or application should be configured for Single Sign-On (SSO) to avoid the user from being presented with a Workspace ONE password login flow (if using Workspace ONE Access). Click Configure to configure a WebXR browser. The settings below can be used for the Wolvic VR Browser on Meta Quest: The following settings can be used for Mozilla Firefox browser on PICO or VIVE Focus devices:

14. Select Create.

15. Select Add Assignment to add new app assignments for your application.

16. Configure flexible deployment settings for your application by editing the schedules and priority for your deployments. Options that are displayed on this window are platform-specific.

    Setting	Description
    Copy	From the ellipses-vertical, you can click copy if you choose to duplicate the assignment configurations.
    Delete	From the ellipses-vertical, you can delete to remove the selected assignment from the application deployment.
    Priority	You can modify the priority of the assignment you configured. Priority is from 0 to N with 0 being the highest priority. For a typical as-soon-as-enrolled deployment, this is set to 0.
    Assignment Name	View the assignment name. Click for details.
    Description	View the assignment description.
    Smart Groups	View the assigned smart group. Click for details.
    App Delivery Method	View how the application pushes to devices. Auto pushes immediately through the Workspace ONE UEM Catalog with no user interaction. On Demand pushes to devices when the user initiates an installation from a catalog.
    EMM Managed Access	View whether the application has adaptive management enabled.

17. Select the Exclusions tab and enter smart groups, organization groups, and user groups you want to exclude from receiving this application.

    • The system applies exclusions from application assignments at the application level.
    • Consider the organization group (OG) hierarchy when adding exclusions. Exclusions at a parent OG do not apply to the devices at the child OG.
    • Exclusions at a child OG do not apply to the devices at the parent OG. Add exclusions at the desired OG.

18. Select Save & Publish.

Edit an Existing XR Hub Configuration

You can make changes to an XR Hub configuration that is already uploaded or assigned.

Any changes made to the application configuration are pushed to devices automatically. Users are alerted to the fact that a new configuration is available and they are asked to restart XR Hub from the users menu.

1. In Workspace ONE UEM, move to the organization group (OG) that manages your headsets.
2. Navigate to Resources > Apps > Native and select the Internal tab.
3. Locate the XR Hub app from the listing. If you have many apps in this listing, an easy way to locate it is to enter "XR Hub" in the Search List text box to the far right, then press enter.
4. Click the edit icon () to the left of the listing for XR Hub. The Edit Application - XR Hub screen displays.
5. You can make changes on this Details tab or other tabs on this screen. When you are done, select the Save & Assign button. The XR Hub - Assignment screen displays.
6. Select the link under the Assignment Name column heading. The Distribution tab for the XR Hub - Assignment screen displays.
7. You can make changes to this tab or other tabs including Application Configuration. For detailed documentation on Application Configuration, see step 13 in XR Hub Configuration options.

Configure Workspace ONE Access for XR Hub

Using Workspace ONE Access is the recommended approach when deploying XR Hub as it provides you the ability to publish any Workspace ONE UEM, Workspace ONE Access, or Horizon managed applications to the XR Hub application launcher. In addition, Workspace ONE Access integration enables advanced authentication flows such as third-party identity providers (Okta, Ping, Active Directory, Azure Active Directory), conditional access, Single Sign-On (SSO), Multi-Factor Authentication, and so on.

For more information, see Configuring Authentication Methods in Omnissa Workspace ONE Access.

Configuring Workspace ONE XR Hub in this way informs Workspace ONE Access that any XR Hub Client is a trusted client for authentication purposes. The following instructions enable you to register the XR Hub Client Template ID and redirect URI with Workspace ONE Access.

1. Log in to the Workspace ONE Access admin console using your tenant admin account.

   

2. Select Settings.

3. Select OAth 2.0 Management.

4. Select the Templates tab.

5. Select the Add Template button. The Create Template dialog box displays.

   This dialog box allows you to enter the XR Hub Client Template ID and Redirect URI. It also lets you choose what types of information (Scopes) your app requests from Workspace ONE Access and the user during End User Authentication.

   

• Template ID: Enter XR_Hub as the Template ID for the XR Hub. This is required to request an instance-specific Client ID and Secret from Workspace ONE Access.
• Scope: Choose the kind of information Workspace ONE Access sends to the XR Hub Client by default. Enable only the following scopes.
  • Email: This allows Workspace ONE Access to grant the XR Hub Client information about the user's email. The email verified attribute indicates whether the user’s email is verified as belonging to the user.
  • Profile: This lets Workspace ONE Access provide the user’s information. The family name attribute provides the user’s last name and the given name attribute provides their first name.
  • User: This lets Workspace ONE Access know that the XR Hub Client needs access to user information.
  • OpenID: This lets Workspace ONE Access know that it should send your app an ID Token after end-user authentication.
• Redirect URI: Enter the redirection endpoint Workspace ONE Access uses to respond to the XR Hub's requests, http://localhost:3000/
  • The trailing / must be included in the URL.

6. Select the Save button to register the XR Hub. You can begin using the XR Hub with Workspace ONE Access.

Enable XR Hub with Read/Write Permissions on Meta Quest

If deploying custom assets or files to Meta Quest devices with Workspace ONE UEM, then XR Hub must be explicitly given Read/Write permissions to access files pushed by UEM.

1. In the Workspace ONE UEM console, navigate to Resources > Profiles & Baselines > Profiles.

2. Select Add > Add Profile, then select Android as the platform.

   

3. Give a name for the profile such as XR Hub Read/Write Permissions.

4. Scroll down and select Custom Settings and select ADD to enable editing.

5. Enter the following in the Custom Settings text field:

   <characteristic uuid="ece876fd-da7d-424f-9bab-85a1b483e95e"  type="com.airwatch.android.androidwork.permissions" target="1">
     <parm name="MasterRuntimePermission" value="1" type="integer" />
     <parm name="AppLevelRuntimePermissions" value="W3sicGFja2FnZU5hbWUiOiJjb20udm13YXJlLnhyLnhyaHViLnF1ZXN0IiwicGVybWlzc2lvbnMiOlt7Im5hbWUiOiJhbmRyb2lkLnBlcm1pc3Npb24uUkVBRF9FWFRFUk5BTF9TVE9SQUdFIiwidmFsdWUiOiIwIn0seyJuYW1lIjoiYW5kcm9pZC5wZXJtaXNzaW9uLldSSVRFX0VYVEVSTkFMX1NUT1JBR0UiLCJ2YWx1ZSI6IjAifV19XQ==" type="string" />
   </characteristic>
   

6. Select Next

7. For Smart Group, select the VR headset smart group(s) to be assigned.

8. Select Save and Publish.

Additionally, you must grant All File Access permission to the Workspace ONE Intelligent Hub client. For more information, see https://techzone.omnissa.com/resource/extended-reality-xr-device-management-augmented-virtual-and-mixed-reality-workspace-one.

Enable XR Hub Kiosk Mode

You can configure a VR device to automatically launch XR Hub at device boot.

The process to set up Workspace ONE XR Hub as the first app to launch differs between supported headsets.

Note: For Meta Quest devices, the configuration must be done as part of staging, before the device is sent to the user.

HTC

Kiosk mode for the HTC VIVE Focus 3 and XR Elite requires pushing an xml configuration file to the device and running an Intent to trigger it.

1. In the Workspace ONE UEM console, move to the organization group (OG) that manages your headsets.

2. Navigate to Devices > Provisioning > Components > Conditions.

   a. Click the ADD CONDITION button, then select Android as the platform. The Create Condition screen displays.

   b. Complete the Condition Settings.

   Setting	Value
   Name	XR Hub for HTC
   Description	XR Hub for HTC is installed
   Condition	File

   c. Select the Next button.

   d. Enter the Condition Details

   Setting	Value
   File Name	/storage/emulated/0/Android/data/com.ws1.xr.xrhub.wavevr
   Condition Met When	File Found
   Frequency	15 minutes
   Duration	1 Day
   After Duration Exceeded	Pass Condition

   e. Select the Save button.

3. Navigate to Devices > Provisioning > Components > Files/Actions.

   a. Use the ADD FILES/ACTIONS button at the top of the page to create a new File/Action.

   b. Select Android.

   c. Configure the General Tab

   Setting	Value
   Name	Download HTC XML Config
   Description	Optional description.
   Managed By	Prepopulated with the correct OG.

   d. Move to the Files tab and select ADD FILES.

   e. Select Choose Files and upload a copy of the mns.xml file shown below, after the last step.

   f. Select Save to save the file.

   g. Specify the download path as /storage/emulated/0/ and select Save to save the configuration.

   h. Move to the Manifest tab.

   i. Select ADD ACTION under the Installation Manifest section.

   j. In the Action(s) To Perform drop-down, select Run Intent.

   k. For Command Line and Arguments to run, enter

   mode=explicit,broadcast=false,action=com.htc.vr.launcher.SCENE,package=com.htc.vrs.launcher,class=com.htc.vr.unity.WVRUnityVRActivity,extraString=LaunchScene=UpdateKioskMode

   l. Select Save to save the Files/Action.

4. Navigate to Devices > Provisioning > Product List View.

   a. Select Add Product and select Android.

   b. Configure the General tab.

   Setting	Value
   Name	HTC Kiosk Mode Config
   Description	Optional description.
   Managed By	Prepopulated with the correct OG.
   Smart Groups	Enter the Smart Group(s) that the product is applied to.

   c. Move to the Manifest tab, select the +Add button, and configure the following.

   Setting	Value
   Actions(s) to Perform	File/Action - Install
   Files/Actions	Select the File/Action created above, called "Download HTC XML Config"

   d. Move to the Conditions tab and select Add for Install Conditions.

   e. In the dropdown list box, select the Condition you created above, named "XR Hub for HTC".

   f. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the Product an active status.

   If you want to activate the product later, navigate to the Product List View page, locate the "HTC Kiosk Mode Config" product from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

Kiosk mode XML file - mns.xml

<?xml version="1.0" encoding="UTF-8"?>
<customization_form>
  <category name="application">
    <module name="vive_kiosk_enabler">
      <function name="enable_kiosk_mode">
        <set name="single">
		<!-- 
		     1:enable kiosk mode. 
		     0: disable kiosk mode
		-->
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
      <function name="kiosk_mode_key">
        <set name="single">
		<!-- [TO DO] Enter a passcode to leave kiosk mode. Needs to be a 4 digit number. Empty means no passcode to leave Kiosk mode -->
          <item name="key" type="int">0000</item>
        </set>
      </function>
	  <!-- allow BT connection or not -->
      <function name="allow_bt_connection">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow headset screen casting not -->
      <function name="enable_screen_casting">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow screen capture or not -->
      <function name="kiosk_screen_captured_enable">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow USB file transfer or not -->
      <function name="allow_usb_transfer">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- setup application in kiosk mode -->
      <function name="kiosk_mode_apps">
        <set name="plenty">
          <item name="app_name">XR Hub</item>
          <item name="app_package_name">com.ws1.xr.xrhub.wavevr</item>
        </set>
      </function>
	  <!-- kiosk mode type 
	       "1" for Single app
           "2" for Multiple app 
      -->
      <function name="kiosk_mode_type">
        <set name="single">
          <item name="enabled" type="int">1</item>
        </set>
      </function>
	  <!-- Network permission under kiosk mode
			"1" for Offline
			"2" for Pre-defined Wifi
			"3" for Allow to any Wifi
      -->
      <function name="allow_network_permission">
        <set name="single">
          <item name="mode" type="int">3</item>
        </set>
      </function>
	  <!-- require sign in mandatory when entering kiosk mode -->
      <function name="enable_kiosk_mode_signin">
        <set name="single">
          <item name="enabled" type="bool">0</item>
        </set>
      </function>
	  <!-- Interaction method
			"1" for hand only
			"2" for controller only
			"3" for controller & hand
      -->
      <function name="kiosk_InteractionMode">
        <set name="single">
          <item name="mode" type="int">3</item>
        </set>
      </function>
	  <!-- play tutorial when re-start kiosk mode -->
      <function name="kiosk_auto_play_tutorial">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
	  <!-- play opening video when re-start kiosk mode -->
      <function name="kiosk_cinematic_playback">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
	  <!-- play wearing guide when re-start kiosk mode -->
      <function name="kiosk_auto_play_wearing_guide">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
    </module>
  </category>
</customization_form>

PICO

Kiosk mode can be configured on Pico devices in one of two ways:

1. Using the XR Hub applicaition configuration

   OR

2. Pushing a configuration file to the device.

Configure Pico Kiosk Mode Using the XR Hub application configuration

1. Refer to Configure Workspace ONE XR Hub
2. Set the Enable Kiosk Mode (Meta Quest/PICO) setting to true.
3. Assign the XR Hub application to your smart group of PICO devices.

Configure Pico Kiosk Mode Pushing a configuration file to the device

1. In the Workspace ONE UEM console, move to the organization group (OG) that manages your headsets.

2. Navigate to Devices > Provisioning > Components > Files/Actions.

   a. Select the ADD FILES/ACTIONS button at the top of the page and Select Android.

   b. Configure the General Tab

   Setting	Value
   Name	PICO Kiosk Mode
   Description	Optional description
   Managed By	Prepopulated with the correct OG.

   c. Move to the Files tab and select the +ADD FILES button. Select Choose Files and upload a text file called config.txt with the following contents, then select Save.

   open_guide:1
   ------
   home_pkg:com.ws1.xr.xrhub.picovr
   ------
   

   3. Specify the download path as /storage/emulated/0/, then select the Save button.

3. In the Workspace ONE UEM console, navigate to Devices > Provisioning > Product List View.

   a. Select the ADD PRODUCT button at the top of the page and select Android.

   b. Configure the General tab

   Setting	Value
   Name	PICO Kiosk Mode Config
   Description	Optional description.
   Managed By	Prepopulated with the correct OG.
   Smart Groups	Enter the Smart Group(s) that the product is applied to.

   c. Move to the Manifest tab and select the +ADD button to add a manifest using these settings.

   Setting	Value
   Actions(s) to Perform	File/Action - Install
   Files/Actions	Select the File/Action created in step 2 above.

   d. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the product an active status.

   If you want to activate the product later, navigate to the Product List View page, locate the "PICO Kiosk Mode Config" product from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

4. Reboot the device for it to take effect

Meta Quest

Native kiosk mode is now available for Meta Quest devices from firmware v74 or later. XR Hub 25.03+ is required to use native kiosk mode on Quest.

Note: A device needs to be factory reset to be switched out of kiosk mode/shared mode

• Kiosk mode requires the device to be configured in Shared Mode via Meta's OEMConfig.apk application provisioned by Workspace ONE UEM.
• XR Hub requires delegated administration rights from Workspace ONE UEM.
• There might be a delay between exiting a 3rd party application and returning to XR Hub.

Give XR Hub Delegated Administration Rights via a Device Profile

1. In the Workspace ONE UEM console, navigate to to Resources > Profiles & Baselines > Profiles.

2. Select Add > Add Profile, then select Android as the platform.

3. Enter a name for the profile such as "XR Hub Delegated Admin".

4. Scroll down and select Custom Setting, then select ADD to enable editing.

5. Enter the following in the Custom Settings text box:

   <characteristic uuid="ee0cdec3-e7c3-4aa6-a8c0-3f3b12fde2sc" type="com.airwatch.android.androidwork.delegatedScopes">
      <parm name="delegationAppRestrictions" value="True" />
      <parm name="delegationAppRestrictionsAppName" value="XR Hub" type="string" />
      <parm name="delegationAppRestrictionsAppId" value="com.ws1.xr.xrhub.quest" type="string" />
   </characteristic>
   

6. Select Next

7. For Smart Group select the VR headset smart group(s) to be assigned.

8. Select Save and Publish.

Setting up Kiosk Mode for Meta Quest using OEMConfig.apk

From Meta Horizon OS firmware v74 or later, Meta provides a native kiosk mode – known as Shared Mode. Meta Shared Mode can be configured by downloading the Meta OEMConfig.apk file from Meta (https://work.meta.com/help/770379388415920?helpref=faq_content). Upload and deploy OEMConfig.apk as an application using Workspace ONE UEM.

1. Upload the OEMConfig.apk to Workspace ONE UEM as an application using the Workspace ONE UEM console, navigate to Resources > Apps > Native Apps, then select the Add button.

2. Assign OEMConfig.apk to the VR headset smart group and configure Application Configuration.

   

3. On the OEMConfig - Assignment screen, in the Application Configuration tab, under Shared Mode, select the EDIT link.

   

4. Add the name of your kiosk mode application activity in the Launcher Component. For example, com.ws1.xr.xrhub.quest/com.unity3d.player.UnityPlayerActivity

5. Enable or disable access to system settings.

6. Select which device settings are available with the admin PIN.

7. Set the Admin PIN.

8. Choose which steps you want to remove from the device setup flow when the device is first rebooted into kiosk mode/shared mode.

9. Select Application Configuration.

10. Select Save.

11. Select Assign and Publish.

After Enabling Shared Mode

Install these modules to the device in the following order.

1. XR Hub
2. Delegated Admin Rights profile
3. OEMConfig

After installing OEMConfig, the device reboots and the user must go through the device setup screens. At that point, the device launches XR Hub in kiosk mode.

Deploy XR Hub Related Files to Devices Using UEM

Workspace ONE UEM can push files to XR devices using the Product Provisioning functionality. "Product" in this case is referring to the files/actions that are grouped together with deployment rules.

Note: For Android 11+ based devices, some file system locations may be inaccessible to either Workspace ONE Intelligent Hub (which places the files on the device) or to the application that is attempting to read these files. For example, Android 12 based devices (Meta Quest/Lenovo VRX) restrict access to application folders such as Android/data and Android/obb. Ensure that you grant All File Access permission to the Workspace ONE Intelligent Hub client. For more information, see https://techzone.omnissa.com/resource/extended-reality-xr-device-management-augmented-virtual-and-mixed-reality-workspace-one.

1. While logged into Workspace ONE UEM, move to the Organization Group (OG) that manages your headsets.

2. Navigate to Devices > Provisioning > Components > Files/Actions and select the Add Files/Actions button followed by Android as the platform. The Add Files/Actions screen displays.

   a. Complete the General tab.

   Setting	Value
   Name	Descriptive name of the file being sent to the device.
   Description	Optional description of the file being sent to the device.
   Managed By	Prepopulated with the correct OG.

   b. Move to the Files tab.

   c. Select the Add Files button. The Add Files window displays.

   d. Select Choose Files and browse for the file you want to deploy.

   • (Optional) You can select more than one file to include in the Files/Action.

   e. Select Save to upload the selected file(s).

   f. Specify the Download Path such as /storage/emulated/0/ws1/foldername and click Save.

   Note: When pushing custom files for XR Hub to a device, you must ensure that the XR Hub application configuration is pointing to the corresponding location of any custom file. For example, ensure that any custom model, artwork etc is configured in the XR Hub application configuration to point to the location where the custom file is deployed. We recommend pushing files to the following location:

   /storage/emulated/0/ws1/folder/filename
   

   Note:

   • If you selected multiple files, you can specify a distinct Download Path for each file.
   • If the path entered does not exist on the device, the installation creates the folder structure.
   • If you support more than one model headset, then you must create separate File-Actions attached to separate products, one for each model.
   • If you have at least one file uploaded, you do not require a Manifest Action.

3. Navigate to Devices > Provisioning > Product List View and select the Add Product button followed by Android as the platform.

   a. In the General tab, apply the following settings.

   Setting	Value
   Name	Provide a name for the product that you can recognize and pick from a list later on.
   Description	Optional description.
   Managed By	Prepopulated with the correct OG.
   Smart Groups	Enter the Smart Group(s) that the product applies to.

   c. In the Manifest tab, select the +ADD button and configure the manifest with the following settings.

   Setting	Value
   Actions(s) to Perform	Select "File/Action - Install".
   Files/Actions	Select the File/Action created in step 2 above.

   d. Select the Save button to save the manifest to the product.

   e. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the product an active status.

   If you want to activate a saved product later, navigate to the Product List View page, locate the name of the product (from step 3a above) from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

Disable the Default Launcher in UEM

If using XR Hub with devices enrolled as multi-user (shared devices) or single-user staging accounts, Workspace ONE UEM automatically attempts to install and launch Workspace ONE Launcher. However, Launcher interferes with the operation of XR Hub, so it is important to block Launcher from running.

Add an Application Group to disable the default Workspace ONE launcher. This prevents Launcher from launching when booting a shared device.

1. While logged into Workspace ONE UEM, change to the Organization Group (OG) that manages your headsets.

2. Navigate to Groups & Settings > Groups > App Groups and select Add Group. The Add Application Group screen displays.

   

3. For Type, select Denylist.

4. For Platform, select Android.

5. Under Name, enter "Disable Launcher".

6. Select the +Add Application link.

   a. Under Application Name, enter "Launcher"

   b. Under Application ID, enter com.airwatch.lockdown.launcher

7. Select Next. The Assignment tab displays.

8. You can accept all the defaults in the Assignment tab. If you followed step 1, the Managed By text box is prepopulated with the correct OG. If you skipped step 1, then, for Managed By, select the name of the OG that manages your headsets.

9. Select Finish.

Collect Logs for XR Hub

An end user can send logs to you, the administrator, using the XR Hub user menu.

User Sends Logs to Workspace ONE UEM

In the User Menu of XR Hub, the user can click on Support > Send Logs and XR Hub and device logs (Workspace ONE agent logs for the device) are sent to Workspace ONE UEM.

The User Menu can be accessed by clicking on the user icon in the top right hand corner of the XR Hub Application Window.

It may take several minutes to send XR Hub logs to Workspace ONE UEM.

View XR Hub Logs using Workspace ONE UEM

1. While logged into Workspace ONE UEM, navigate to Devices > List View and select the user device for which you want the logs.
2. Select the More drop down menu, then select Attachments.
3. Select Documents.
4. A list of logs for XR Hub and possibly device logs display.
5. Select the filename starting with "AppLog-" to download the XR Hub logs.

The app log captures all relevant logging for XR Hub both from the device operating system and XR Hub itself. Entries in the application log specific to XR Hub begin with "VXRLog".