Key Policies of Omnissa Workspace ONE Web

Customize the behavior of Workspace ONE Web by applying different key policies to meet the specifications of your organization.

To configure Workspace ONE Web with the configuration keys, you must follow these steps:

1. Log in to the Workspace ONE UEM console.
2. Go to Groups & Settings > All Settings > Apps > Settings and Policies > Settings.
3. Add the configuration keys to the Custom Settings field.

General Policies

"BrowserDisableUserAgentString" : "true"

"BrowserDisableAutoCloseTab" : "true" 

"BrowserDisableWebclip" : "true"

 "BrowserDisableLongPressOnLinks" : "true" 

Admin Policies for Privacy and Data Collection

Use the configuration keys in the UEM console to perform additional privacy disclosure and data collection practices. End users who are upgrading or beginning to use the latest version (from v6.14 onwards on iOS and Android platform) are presented with new privacy prompt screen upon the start of the application.

The privacy prompt screen lets the user know the following device information is fetched by the application:

• Data collected by the app – Provides a summary of data that is collected and processed by the application. Some of this data are visible to administrators of the Workspace ONE UEM administration console.

• Device Permissions – Provides a summary of device permissions requested for the app to enable product features and functionality, such as push notifications to the device.

• Company's privacy policy – By default, a message is shown to the user to contact their employer for more information. Users are recommended to configure their privacy policy URL in the UEM console. After configured, the users can open the employer’s privacy policy within the application.

To enable privacy and data collection policies, enter the configuration key and the corresponding value in Custom Settings under Groups & Settings > All Settings > Apps > Settings and Policies > Settings.

 "PolicyAllowFeatureAnalytics": 0 

 "PolicyAllowCrashReporting" : "true" 

 "PrivacyPolicyLink" 

Normal Browsing Mode

Disable QR Code on the Browser

"BrowserDisableQRCode" : "true"

Configure Web Clips in Full Screen Mode

By default, web clips are displayed in normal mode in the Workspace ONE Web Bookmarks. If you want your user to view the web clips in full screen mode, set the URL prefix as awbf:// and awbfs://. For more information on the web clip configuration process, refer to the Platform Guide.

If you want to enforce full screen mode, you can configure Workspace ONE Web using the following configuration key. This key provides a more secure and restricted experience for your end users when using web clips in full screen mode. If configured, this key:

• Opens webclips in full screen mode without allowing users to exit.
• Hides the URL address bar, navigation controls, and other Web features to minimize user distractions.
• Prevents sensitive URLs from being exposed to end users for malicious or accidental misuse.

"EnableForcedFullScreenWithAwbfs" : "true"

Kiosk Browsing Mode

Single tab Kiosk Browsing Mode

Customize the Display of the URL Address Bar

Hide the URL address bar in single-tab Kiosk mode to reduce user distraction. To do so, you must use the following key-value pair.

"HideURLBarInKioskMode" : "true"

Hide Navigation Controls

"HideNavigationControlsInKioskMode" : "false"

Multi tab Kiosk Browsing Mode

Editing URL in Multi tab Kiosk Mode

 "EditURLBarInKioskMode" : "true" 

Single and Multi tab Kiosk Browsing Mode

• Disable Long Press

  Configuration Key	Value Type	Configuration Value	Description
  DisableLongPressInKiosk	Boolean	true or false (default)	When set to true, Workspace ONE Web disables the long-press option to prevent unintended actions on websites. Applies only in kiosk mode.

• Enabling Print Option in Kiosk Mode

  Configuration Key	Value Type	Configuration Value	Description
  BrowserAllowPrintInKiosk	Boolean	true or false (default)	Set to true to enable printing in kiosk mode. Note: Printing must also be allowed in the SDK DLP settings.

• Scan URL QR Codes in Kiosk Mode

  Configuration Key	Value Type	Configuration Value	Description
  EnableQRInKioskMode	Boolean	true or false (default)	Displays a QR scanner in the URL address bar when set to true. Note: Applies only when EditURLBarInKioskMode is set to true.

• Clear Cache, Cookies, and History when device is in Kiosk Mode(iOS only)

  Configuration Key	Value Type	Configuration Value	Description
  ClearDataInKioskMode	Boolean	true or false (default)	When this custom setting is set to true, user can select the clear cache, cookies and history action from Settings in single and multi tab kiosk mode.

Display Privacy Dialog Box

"DisplayPrivacyDialog" : 1

Enabling SDK logging on iOS Web

To enable the SDK logging on Web, use the following configuration key. This key provides a fallback if you want to log browser logs in the SDK logging framework.

"BrowserEnableLoggingToSDK" : "true"

Redirect mailto: Links to your Favorite Email Clients

By default, Workspace ONE Web opens mailto: links in Workspace ONE Boxer or in the iOS native email application when the Data Loss Prevention (DLP) option is disabled. As an admin, you can change this behavior by configuring Web to open mailto: links in any configured third-party email client.

To apply the mailto: setting in Workspace ONE Web, you must add the following configuration in the Custom Settings. Before you configure, make sure that you have deactivated the Enable Composing Email option under the SDK DLP setting.

 "com_ws1_DLP_Redirection": {
                "mailtoSchemeconfiguration": {
                    "mailto": "ms-outlook",
                    "appName": "Outlook"
                },
                "httpSchemeConfiguration": {
                    "https": "Awweb",
                    "http": "AWWeb",
                    "appName": "Web"
                }
            }

Enable Web Fullscreen mode

With Workspace ONE Web, users can browse content in the Fullscreen viewing mode. Fullscreen mode hides the URL and the navigation bar and displays only the content. Users can exit the fullscreen mode either by a long press on the screen or stop and relaunch the Web application.

By default, the fullscreen mode is enabled, and admin can deactivate this mode using the following KVP:

"DisableFullscreenMode" : "true"

SCEP Integrated Authentication

Use the integrated authentication with an authentication type set to SCEP certificates in the UEM console by configuring the following key value pairs.

"ScepPendingRetryTimeout"

"ScepPendingMaxRetryAttempts"

View Downloaded Files in Workspace ONE Content for Android Devices

To view the downloaded files in the Workspace ONE Content app, use this configuration key in the UEM console. Users must install and configure the Content application on their device to view the supported files. For more information about files supported by the Content application, see the Matrix of Supported File Type by Platform topic in the Mobile Content Management documentation.

"BrowserAutoOpenInContent" : "true"

Add a Custom String to the Browser User Agent

As an admin, you can pass an identifier to Workspace ONE Web that appends to the user agent string. This identifier is an optional parameter and applies to both mobile and desktop user agent. It does not support double byte characters and rich text.

"BrowserUserAgentPostfix"

 "BrowserUserAgentPostfix": "This is the appended string" 

Configure Workspace ONE Web to Use a PAC File

You can configure Workspace ONE Web to use the Proxy Auto-Configuration (PAC) file to allow your web traffic to pass through the proxy server. A PAC file is a text file that directs a browser to a proxy server before it reaches the destination server.

"BrowserPacURL"

"BrowserPacMode"

{
"BrowserPacURL": "https://mypac.mydomain.com/pacfile"
"BrowserPacMode": 1
} 

{
"BrowserPacURL": "https://mypac.mydomain.com/pacfile"
"BrowserPacMode": 2
} 

WebRTC Support in Workspace ONE Web (Android only)

With WebRTC, websites can easily access the camera and microphone in Workspace ONE Web for Web Real-Time Communication. To enable this feature, you must configure the Web application with the following KVP.

 "BrowserEnableWebRTC" : "true"

Workspace ONE Web lets the end users remember their choice to allow or block camera or microphone settings for individual websites by selecting Remember my choice setting. By selecting Remember my choice setting, they can conveniently load the websites next time without the pop-up dialog box asking for the same permissions again.

Configure iOS Web to Support Shortened URLs

Use the shortened or non-FQDN (Fully qualified domain name) URLs to access the websites of your organization by adding the following Key-value pair. This Key eliminates the need to add HTTP or HTTPs to the URLs.

"BrowserShortlinkPrefix": ["wmlink","company_name"]

Set Up a Retention Period for Downloaded Files

Use the following key to configure a retention period for the downloaded files in Workspace ONE Web.

"BrowserRetainDownloads" : "day"

Automatically Open Downloaded Files (Android only)

Use the following key to configure Workspace ONE Web for Android to open the downloaded files automatically in a default application.

"BrowserAutoOpenDownload" : "false"

Support for Android App Links

Configure Workspace ONE Web for Android to launch an intended application from an app link. You can use the following configuration key to enable this behavior on Web.

"BrowserAllowAppLink": "true"

Block Popup Windows in Web

Configure Workspace ONE Web to prevent JavaScripts from opening popup windows without any user interaction.

 "BlockPopupWindows" : "true" 

Enable WebSDK (iOS only)

Use the following key value pair to enable WebSDK in Workpsace ONE Web for iOS.

"BrowseriOSDisableWebSDK" : "true"

Enable Secure Browsing

Configure Workspace ONE Web to provide secure browsing experience to the the end users. Use the following key value pair to use HTTPS protocol to load all URLs in Workpsace ONE Web for iOS and android.

"BrowserForceHttps" : "true"

Activate Watermark Support

You can configure Workspace ONE Web to show a custom watermark text on the websites accessed through the app. This feature protects any sensitive information from being exposed through websites browsed using Web. The bookmark is preserved even if the user tries to print a webage using the print option available in the app. To configure, you must:

1. Navigate to Groups and Settings > Settings > Apps > Settings and Policies > Security Policies.
2. Enable Data Loss Prevention.
3. Select Yes.
4. Enter the text you want to show up as a watermark in the Overlay Text field.
5. Click Save.

Restrict file download/upload based on file type

You can restrict users from downloading or uploading specific files in Workspace ONE Web based on the type of file being downloaded or uploaded. To configure these restrictions, you must add the following SDK custom setting to the Workspace ONE UEM console:

 "restrict_download": {
 "type":"Allow", 
"file_extensions": ["zip", "ms*"]
"file_mime_types": ["application/pdf"] 

 "restrict_upload": {
 "type":"Deny", 
"file_extensions": ["zip", "ms*"] 
"file_mime_types": ["application/pdf"]

Deactivate SDK Blocker Screen (iOS Only)

You can use this following KVP to deactivate the SDK blocker screen security.

"DisableBlockerScreenSecurity": "true"

Add a Search Engine

Use the following KVP to offer users additional options for search engines in addition to the default ones.

  "AddSearchEngines": [
    {
      "name": "Search Engine 1",
      "search_url": "https://www.si1.com/search?q="
    },
    {
      "name": "Search Engine 2",
      "search_url": "https://www.si2.com/search?q="
    }
  ]

Resign Keyboard On Splash Screen

 "ResignKeyboardOnSplashScreen" : "true" 

Support WKWebView for In-App Tunnel

 "EnableWKWebViewForTunnel" : "true" 

Manage Keyboard with Auto Focus Attribute

 "ShowKeyboardOnFocus" : "true" 

Viewing site cache and cookies storage (iOS only)

You can restrict users from viewing and managing cache and cookies by using the following key.

 "HideCacheAndCookies" : "false" 

Sync the Web page using Pull to Refresh

 "BrowserPullToRefresh" : "true" 

Allow Widgets Popup

"AllowWidgetsPopUp" : "true"

Show Notification Prompt Once (Android Only)

"ShowNotificationPromptOnce" : "true"

Support Per-Site Management of Camera, Microphone, and Location Permissions (iOS Only)

"AllowWebsiteLevelPermission" : "true"

Custom tab support for Third Party apps using NO_HISTORY intent flag (Android Only)

"ForwardIntentExtrasToSplashActivity" : "true"

Send GPS data from Workspace ONE Web to Workspace ONE UEM (iOS Only)

"AllowGPSData" : "true"

Suppress alert from websites containing untrusted resource

"HideUntrustedSiteAlert" : "true"

Allow writing tools on apps (iOS Only)

"AllowWritingTools" : "false"

Microsoft Conditional Access authentication (Android Only)

"MSConditionalAccess": {
    "domains": [
      "device.login.microsoftonline.com"
    ]
  }

Web page summarization for Apple Intelligence devices (iOS Only)

"AllowWebpageSumarrisation" : "true"

Enable Email logging