Setting up iPad’s for Field Workers using Workspace ONE

Post navigation

Many organisations need to deploy iPhone or iPad devices to their field workers so they can perform their job whilst on the move. Apple devices allow them them to access public and corporate information quickly and easily, using the iOS operating system which is easy to use.

iPad devices can also be configured as kiosk terminals so only selected mobile apps or web pages are displayed on the device.

The purposes of this article is to step you through the entire configuration process of using Workspace ONE UEM to deploy large number of devices quickly and easily.

I’d like to thank Dany Leclerc, Pratheep Vinayagamoorthyand Eri Ang for helping various configuration settings in this article, which weren’t documented in a single place previously.

Apple Push Notification Service (APNs)

As detailed in the Getting Started with Workspace ONE UEM guide, Apple Push Notification service (APNs) is the messaging protocol created by Apple to manage mobile devices. To manage iOS devices, Workspace ONE UEM requires a valid APNs certificate. This exercise helps you to generate the APNs certificate.

1. In Workspace ONE UEM Console, navigate to Getting Started > Workspace ONE. Navigate to Apple Push Notification Service (APNs) and click Configure

1. Navigate to Apple Push Notification Service (APNs) and click Configure.
2. Under Download Certificate Request, click MDM_APNsRequest.plist. Click Continue. Save this file to your computer.
3. Enter your corporate Apple ID email address that you will use to manage all Apple devices for your organization. If you do not have a corporate Apple ID, Create an Account with Apple.

Important: Do not use a personal Apple ID. If the user leaves the organization and you cannot renew the certificate, you must re-enroll all iOS devices!

1. Go to the Apple Push Certificates Portal and use your corporate Apple ID credentials to authenticate. Complete the following steps to create the APNs certificate.
2. Enter your corporate Apple ID
3. Enter your Apple ID password
4. Click Sign In.
5. Click Create a Certificate.
6. Click Choose File and select the MDM_APNsRequest.plist you downloaded previously.
7. Click Upload.
8. The Apple Push Certificates Portal will issue you with a certificate. Click Download.
9. Return to the Getting Started wizard in the Workspace ONE UEM console, and click Next.
10. Click Upload.
11. Click Choose File and select the previously downloaded .pem  file.
12. Click Save.
13. Enter your Apple ID. For example, [email protected].
14. Click Save.
15. Enter the security PIN, if prompted.
16. You should be redirected to Devices & Users > Apple > APNs for MDM. If not, navigate to that location and click Test Connection.

You can now manually enrolled an iOS or iPadOS device into Workspace ONE UEM.

Automated Device Enrollment Setup

Automated Device Enrolment from Apple (previously known as Device Enrolment Program or DEP) lets you automate enrolment into Workspace ONE UEM and simplify initial device setup. You can supervise devices during activation without touching them, and lock MDM enrolment for ongoing management.

You’ll need to have an Apple Business Manager account. The following article from Apple details how to obtain one.

The following video titled Workspace ONE UEM: Auto-Device Enrollment – Feature Walk-through shows you how to set this up with Workspace ONE UEM.

For the purposes of setting up a device as a kiosk (no authentication) I configured the following for my DEP profile settings:

You’ll also want to ensure you enable Supervision of the devices and likely Enable the Lock MDM Profile setting too:

Note that I set a default staging user called iOS Kiosk which was a basic user in Workspace ONE UEM as follows:

If you have added you iOS devices to Apple Business Manager (ABM) and those devices have synchronised through to Workspace ONE UEM, you should then be able to turn on a new device and it will enrol automatically.

What if I don’t have a device added to ABM? (for example, I have an existing iOS device). Then see this very useful video titled VMware Workspace ONE UEM 9.2: DEP Registration in iOS 11 – Feature Walk-through on how to do this.

Setup Volume Purchase Program (VPP) Managed Distribution

We’ll now integrate Apple VPP within Workspace ONE so that we can distribute public iOS applications (including the Workspace UEM UEM Hub) without the user needing to login with their Apple ID to receive any applications.

In Workspace ONE UEM:

1. Click Groups & Settings.
2. Click Configurations.
3. Scroll down through the list of Configurations.
4. Select VPP Managed Distribution
5. Ensure the Current Setting is set to Override.
6. Enter a friendly name for the Location.
7. Click Upload.
8. In the dialog box, click Choose File. Browse to and select the vpptoken file downloaded in Download Token from Apple Business Manager, and select Choose.
9. Click Save.
10. Click Save.

Within ABM, add your public iOS applications such as the Intelligent Hub. Add any other public apps as required:

By default, Workspace ONE syncs managed distribution licenses for custom apps and volume-licensed public apps daily. The sync is scheduled automatically, allowing Workspace ONE to reconcile newly purchased licenses and updated metadata (descriptions and images). When you upload a location token, you can speed up this process by manually initiating a license sync.

Managed distribution licenses can be assigned on a per-user, or per-device basis. For the per-user licensing model, the end-user of the device is prompted to enter their Apple ID credentials into the device to assign the license. In other words, per-user license distribution requires that all users have an Apple ID.

What we want however is the per-device licensing model. In this case the managed distribution licenses are assigned directly to the device regardless of whether the user has entered Apple ID information. The end-user is not required to have an Apple ID in order for the app to be assigned to the device and installed from the App Store.

Select a number of applications and select Enable Device Assignment

For your applications you’ll want to assign them to All Devices and set the distribution to Auto, so the applications are deployed when the device is enrolled into Workspace ONE UEM.

I’d recommend you perform a full wipe of the device, then test the device automatically enrols into Workspace ONE UEM and the Hub is automatically deployed.

The following are two images from my test iPad:

Remote Support with Workspace ONE Assist

If you’ve purchased Workspace ONE Assist, you’ll see the licenses activated in the Admin Panel as shown:

The great news is that Assist is built into the Hub application itself. All you need to do is enable the Screen Recording option within your iOS device as per this article.

Now from the UEM console, find your device from the Devices menu. Select your device then select Remote Assist as shown:

Ensure your web browser is not blocking any pop up screens. You should then see it attempt to connect to the device as shown:

On the iPad, you should hear a sound and see messages as per the following. Select Shart Starting then Start Broadcast to initiate the remote view of the iPad’s screen:

Y

Then from the Workspace ONE UEM console you’ll be able to remotely view the iPad’s screen as shown:

What if I get any errors when trying to initiate an Assist session? Ensure the Hub is first started on the iOS device. This can take a short time to then register the device with the Assist server. Try again and it should then work.

Device Policies

It is recommended to set some device policies such as minimum passcode and other applicable settings for your devices such as WiFi, VPN etc.

Single Application Kiosk Mode or Showing Selected Apps

Workspace ONE UEM can configure your iOS or iPadOS devices to present a single application as the primary interaction for users. The user will only have access to the application, and cannot access the device’s Springboard. This configuration is used to create a kiosk or digital signage using your iOS and iPadOS devices.

1. Navigate to Devices > Profiles & Resources > Profiles > Add > Add Profile > iOS.
2. In the General Tab, provide a name for the profile and assign the profile to smart groups that include your kiosk devices.
3. Select the Single App Mode payload, and select Configure.
4. Select Lock device into a single app.
5. Type the Bundle ID of the application that the devices need to be locked to.Note: By default, all functions on the device will be configured to be disabled. You may choose to enable any particular setting if necessary for your custom needs. Else, proceed to Save and Publish.
6. Select Save to complete the Launcher configuration.
7. Select Save and Publish.

In this mode, Assist will not be operational since it needs to allowed to run on the device.

The alternative is to show and hide applications on iOS instead. That way you ensure that only corporate applications are accessible on the device by creating the following profile. I’ve shown what it looks like on the iPad too:

No Authentication?

You will have observed that the iPads haven’t required any form of authentication when the device is setup.

Would this be an issue if the device was lost or stolen? For your company, you might with to enable authentication which must be provided when the device is setup during the initial iOS setup phase. This is enabled on the UEM console as follows:

The user is then required to authenticate when the device during the initial device configuration as follows:

This is before the iOS device has reached the home screen.

Conclusion

That’s it! You can now easily deploy your iPads to your field workers and remotely support them (as long as they have some form of Internet connection).

Acknowledgement: Main iPad image with rugged case from link