Workspace ONE Assist supports Remote Control for Android, macOS, Windows Desktops , and Windows Mobile devices. iOS devices are supported but only as far as the Remote View feature.
Android Devices
Android devices managed by Workspace ONE Intelligent Hub 20.11 or later.
Download and install the latest version of the Workspace ONE Assist APK from the My Workspace ONE ™ documentation repository (https://my.workspaceone.com/).
Android devices running Android 5.1 (Lollipop) or later support Remote View ONLY without a corresponding service application.
Android devices running Android 4.4 (Kit Kat) support full remote control with a corresponding OEM-specific service application installed. Download and install this OEM-specific service application by visiting the My Workspace ONE ™ documentation repository (https://my.workspaceone.com/). Devices manufactured by Samsung, Sony, Motorola (LEX 11 models only), and Zebra (Android 11 and later only) support full remote control without a corresponding OEM-specific service application.
With Assist 21.09, Android devices running Android 7.1 and later no longer require a OEM-specific service application to be installed to support full remote control. For full remote control, end users must provide additional permissions such as:
Enable screen share for every session on Android 10 and later.
Enable accessibility service for each remote control session.
Note:Accessibility service cannot be enabled within a Work Profile, hence, remote control using Accessibility service cannot be leveraged on COPE and BYOD devices.
Samsung devices operating with a Work Profile in a BYOD or COPE enrollment require the Knox Service Plugin application (except those running Android 10 and later) to be installed after the Assist Agent is installed. For more information, see How Do You Enable Remote Control with Samsung Knox Service Plugin.
On Samsung devices without the KNOX libraries, Workspace ONE Assist supports Remote View, File Manager, and Command Line client tools only. The Remote View functionality requires that the device end user allows screen sharing at the start of a session.
On devices running Android 9 and older, this is a one-time prompt.
On devices running Android 10 and later, this prompt must be accepted by the device end user at the start of each Assist session.
Starting with Android 11, the Assist Android agent uses Zebra-provided remote management APIs to support the remote control functionality. Hence, Android 11 and later devices do not require a separate service download.
The following are the minimum requirements:
MXMF version 10 or later (this is usually pre-loaded with the firmware)
Zebra MX Service 5.2 or later
Assist Agent 22.03 or later
Intelligent Hub 21.09 or later
Note:The Remote View functionality in Attended mode of connection requires the device end user to allow screen sharing on the device for the admin to view the screen.
On Zebra devices running Android 11 and later, this prompt must be accepted by the device end user at the start of each Assist session and/or when the device is restarted while in an Assist session.
With Assist 23.02 and Android 11 (Firmware version R3.3 (R40.33.10), full Remote Control is supported in Motorola LEX 11 devices. The Assist Android agent uses Motorola provided remote management APIs to support the remote control functionality. All functionalities that exist within Assist including the touch and key injection events are now available through the Motorola remote management APIs.
On Android 13, Google has introduced a new runtime permission for notifications that users must approve (which was pre-approved earlier). However, Workspace ONE Assist requires this runtime permission to be pre-granted in order to support Unattended remote control. Workspace ONE Intelligent Hub automatically grants the POST_NOTIFICATIONS permission to the Workspace ONE Assist agent. You must ensure to upgrade both Workspace One Intelligent Hub and Workspace ONE Assist agent to 22.10 version to support Unattended remote control on Android 13.
With Assist 23.02, Zebra devices that are connected to external monitors through the Workstation Connect Cradle or Connect Hub can be viewed and controlled through the Assist session. The Multi-monitor button appears in the admin console when the Zebra device has an external monitor connected. It allows the admin to switch between the displays they want to view or control. Please note that only one monitor may be viewed or controlled at any given time.
For details, see Supported Features by Enrollment Type and Ownership, Android and Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android.
Android devices enrolled to Workspace ONE UEM in Registered Mode are also supported. For details on configuring the registered mode, see the Registering Android with Workspace ONE UEM topic of the Android Device Management documentation.
Note:Devices in Workspace ONE registered mode are not MDM managed.
Windows Desktop Devices
Windows 10 devices running Windows 10 Anniversary Update (version 1607, code named Redstone 1) or later for Enterprise and Professional editions only.
Windows 11 devices running 21H1 or later for Enterprise and Professional editions only.
Windows 10 Enterprise Long-Term Servicing Channel (LTSC)
Windows Desktop in Kiosk Mode
Windows Enterprise IoT devices (*64 bit systems)
Windows Enterprise IoT LTSC devices (*64 bit systems)
Microsoft .NET framework 4.6.2
64-bit OS required.
Managed by Workspace ONE Intelligent Hub 20.11 or later.
Windows Desktops enrolled to Workspace ONE UEM in Registered Mode are also supported. For details on configuring registered mode, see the Enrolling Windows 10 Devices into Workspace ONE UEM topic of the Windows Desktop Documentation.
Note:Devices in Workspace ONE registered mode are not MDM managed.
Remote Assist sessions are also supported in Windows desktops where no user is logged in. Minimum Requirement is Workspace ONE UEM 2210 or later and Workspace ONE Intelligent Hub 22.06 or later.
For Assist 23.02, the minimum OS version supported is 1803 or later.
Download and install the latest version of the Workspace ONE Assist agent (MSI file) from the My Workspace ONE ™ documentation repository (https://my.workspaceone.com/).
iOS Devices
Managed iOS devices can only be viewed using Remote View, a feature in Workspace ONE Assist. iOS devices do not require a separate Assist app.
iOS devices running version 12.2 or later.
Managed by Workspace ONE Intelligent Hub 20.11 or later.
On Workspace ONE UEM version prior to 2101, no configurations needed to enable Remote view on iOS devices
On Workspace ONE UEM version 2101 or later, a privacy flag is introduced to activate or deactivate Remote View on iOS devices at an Organization Group (OG) level.
To configure the privacy flag, navigate to
. On the Privacy screen, turn on or off the Remote Control flag for each ownership type. On existing Customer Organization Groups, this flag value remains the same as the previous value set prior to the 2101 upgrade. On new Customer Organization Groups, this flag is deactivated by default. To activate Remote view, turn on the flag for the necessary ownership types.iOS devices enrolled to Workspace ONE UEM in Registered Mode are also supported.
Note:Devices in Workspace ONE registered mode are not MDM managed.
macOS Devices
macOS devices can only be remotely controlled with the Share Screen client tool provided they are within these specifications and environments.
Managed by Workspace ONE Intelligent Hub 20.11 or later.
Workspace ONE UEM 2011 or later.
macOS devices running 10.15 (Catalina) or later.
On mac m1 devices with apple silicon, a separate Rosetta2 installation had to be performed for Assist to function properly. In the 2203 release, we have included the Rosetta2 in the Assist package itself and a separate installation is not required.
-
Note:
With regard to the permission prompts for the Remote View and Remote Control functions on macOS devices, be aware of the following.
- macOS devices running version 10.14 (Mojave) allow the Share Screen feature by default. No additional permissions are required to share the screen, therefore, no prompt is displayed at the beginning of a Share Screen session.
- For macOS devices running version 10.15 (Catalina), the Share Screen and Remote View features both require that you enable the Screen Recording permission to Workspace ONE Assist in the Privacy tab of Security & Privacy preferences, located in System Preferences. Only during the first time you initiate a Share Screen session with a qualifying macOS device, an access request popup displays including a convenience link to this privacy setting in System Preferences.
- Similarly, macOS devices running version 11 (Big Sur) or later must enable Screen Recording permission to Workspace ONE Assist for both Remote View and Share Screen features. This permission is configured in a slightly different way for version 11:
Enable Screen Recording by navigating to Lock icon to unlock the Privacy settings and enter the Administrator password. This is a one-time activation by the end user.
then select the - For Unattended mode in MacOS, Screen Share tool has two possible flows to auto-grant the Screen Recording permissions.
- If a user is logged into the device, the Screen Recording permission is granted automatically before the start of each Screen Share session by pushing a TCC profile from the UEM console. Before each Screen Share session, the Assist Agent checks if the permission is already granted. If the permission is granted, the connection goes through. If the permission is not granted, Assist agent grants the permission while the Screen Share connection is in progress. This is a safe way since the permission can be revoked anytime by the end user. The TCC profile is bundled with the Assist 23.02 agent package and can be downloaded from the My Workspace ONE ™ portal.
- If there is no user logged into the device, the Screen Recording permission cannot be granted automatically. In such a situation, the admin has to log into any user account for the automatic Screen Recording permission to kick-in. This can be done by passing username and password using following commands through Remote Shell Tool, these steps are essentially just to enter username and passwords on the remote Mac.
To achieve this connect to Remote Shell tool and log in to their user account by entering the listed commands.
osascript -e ‘tell application “System Events” to keystroke “<user name>"’
osascript -e ‘tell application “System Events” to keystroke return’
osascript -e ‘tell application “System Events” to keystroke "<password>"’
osascript -e ‘tell application “System Events” to keystroke return’
Once these commands are executed, the admin console might show a brief interruption of the remote session while the user is logged in and eventually will re-connect. Now once user is logged in, the Screen Recording permission is granted automatically and the admin can view the screen right after that. This is a one time procedure and need not be performed in subsequent session as long as the permission is not revoked by the user. If the Screen Recording permissions are already granted before the start of connection, the connection goes through and there is no need to connect to Remote Shell tool.
Irrespectively, if the connection is only either Remote Shell and/or File Manager then there are no limitations as above, and Unattended connection goes through without providing additional permission other than configuring TCC profile.
-
Download and install the latest version of the Workspace ONE Assist agent from the My Workspace ONE ™ documentation repository (https://my.workspaceone.com/).
Windows Mobile
Windows Mobile/CE running .NET 2.0 or later.
Managed by Workspace ONE Intelligent Hub 6.0.4 or later.
Download and install the latest version of the Workspace ONE Assist agent (MSI file) from the My Workspace ONE ™ documentation repository (https://my.workspaceone.com/).
Linux Devices
Supports Linux x64, ARM5, or ARM7 architecture.
Linux installer files of deb, rpm, and tgz types are available.
The following functionalities are available in Assist Linux 21.11 release:
Ability to manage the file system on the remote device using the File Manager tool.
Ability to run commands on the remote device using the Remote Shell tool.
Role based access controls to File Manager and Remote Shell functionality.
Note:Assist sessions on Linux devices support Unattended access only in the 21.11 release. The ability to view and control a device screen will be introduced in upcoming releases.
Assist is currently only available on SystemD Linux devices and SystemV devices are not yet supported.
Supported Features by Enrollment Type and Ownership, Android
Feature support for Android devices can be categorized by enrollment type (legacy, COPE, BYOD, Fully-Managed), ownership (Personal, Work Profile), and whether the device is made by Samsung or not.
Zebra Devices |
||||||
---|---|---|---|---|---|---|
Enrollment Type |
Ownership |
Remote Management |
OS Version |
Assist Presence |
API's Used |
User Prompts |
Legacy |
Device Administrator |
Supported |
Android 5.0 – 9.x |
Provisioned as an internal application. |
Stub permissions |
None for unattended mode. PIN entry for attended mode. |
Fully Managed |
Device Owner |
Supported |
Android 5.0 - 10.x |
Provisioned as an internal application. |
Stub permissions |
None for unattended mode. PIN entry for attended mode. |
Device Owner |
Supported |
Android 11 and later |
Provisioned as an internal application. |
Zebra API's - The following additional APIs are provided by Zebra -
|
None for unattended mode. PIN entry for attended mode. |
Samsung Devices |
|||||||
---|---|---|---|---|---|---|---|
Enrollment Type |
Ownership |
Assist Features -Remote View / Control / FM / CLI |
OS Version |
Assist Presence |
Knox Plugin |
API's Used |
User Prompts |
Legacy |
Device Administrator |
Supported |
Android 5.0 – 9.x |
Provisioned as an internal application. |
Not Required, but a Knox EULA prompt is displayed one time. |
Samsung Knox APIs for View and Control. If Knox not available, Google APIs for Remote View only |
|
Fully Managed |
Device Owner |
Supported |
Android 5.0 and later |
Provisioned as an internal application. |
Not Required, but a Knox EULA prompt is displayed one time. |
||
BYOD |
Personal Profile |
Remote View / Control Not Supported |
n/a |
n/a |
n/a |
n/a |
n/a |
Work Profile |
Supported (view and control Work profile apps only) |
Android 9.x |
Provisioned as a public application from the play store. |
Required, including a Premium Knox License Key to activate remote control APIs. |
Samsung Knox APIs for View and Control. ONLY work applications can be viewed and controlled after being launched by end-user. If Knox not available, Google APIs for Remote View. With Google APIs, entire device can be viewed. |
|
|
Android 10.x |
Provisioned as a public application from the play store. |
Not Required for non-premium work profiles. |
|||||
COPE |
Personal Profile |
Supported |
Android 9.x ONLY |
Provisioned as an internal application. |
Required, including a Premium Knox License Key to activate remote control APIs. |
Samsung Knox APIs for View and Control. Entire device can be viewed. If Knox not available, Google APIs for Remote View. With Google APIs, entire device can be viewed. |
|
Android 10.x |
Provisioned as an internal application. |
Not Required for non-premium work profiles. |
|||||
Not Supported |
Android 11 and later |
Provisioned as a public application from the play store. |
n/a |
n/a |
n/a |
||
Work Profile |
Supported |
Android 9.x and 10.x |
Provisioned as an internal application. |
Not required for non-premium work profiles. |
Samsung Knox APIs for View and Control. Remote view and control Work profile apps only after it's launched. If Knox not available, Google APIs for Remote View. With Google APIs, entire device can be viewed. |
|
|
Android 11 and later |
Provisioned as a public application from the play store. |
Not Required for non-premium work profiles. |
Samsung Knox APIs for View and Control. Remote view and control Work profile apps only after its launched. If Knox not available, Google APIs for Remote View. With Google APIs, entire device can be viewed. |
Other Devices (with OEM-signed Assist Service) |
||||||
---|---|---|---|---|---|---|
Enrollment Type |
Ownership |
Remote Management |
OS Version |
Assist Presence |
API's Used |
User Prompts |
Legacy |
Device Administrator |
Supported |
Android 5.0 – 9.x |
Provisioned as an internal application. |
Stub permissions |
SD card permission if the SD card data is accessed on some OEMs like Honeywell. |
Fully Managed |
Device Owner |
Supported |
Android 5.0 and later. |
Provisioned as an internal application. |
Stub permissions |
|
BYOD |
Personal Profile |
Not Supported |
Android 5.0 and later. |
n/a |
||
Work Profile |
Supported |
Android 5.0 and later. |
Provisioned as a public application from the play store. |
Stub permissions |
||
COPE |
Personal Profile |
Supported |
Android 9.x and 10.x ONLY. |
Provisioned as an internal application. |
Stub permissions |
|
Not Supported |
Android 11.x and later. |
n/a |
||||
Work Profile |
Supported |
Android 9.x and 10.x. |
Provisioned as an internal application. |
Stub permissions |
||
Android 11.x and later. |
Provisioned as a public application from the play store. |
Stub permissions |
Other Devices (without OEM-signed Assist Service) |
||||||
---|---|---|---|---|---|---|
Enrollment Type |
Ownership |
Remote Management |
OS Version |
Assist Presence |
APIs Used |
User Permissions |
Legacy |
Device Administrator |
Remote View ONLY Supported |
Android 5.0 – 9.x |
Provisioned as an internal application. |
Google Screen Share API's |
PLUS
|
Fully Managed |
Device Owner |
Remote View ONLY with assist agent version less than 21.09. Remote Control with assist agent 21.09 or later with Accessibility permission request. |
Android 5.0 and later. |
Provisioned as an internal application. |
||
BYOD |
Personal Profile |
Not Supported |
n/a |
n/a |
||
Work Profile |
Remote View ONLY Supported |
Android 5.0 and later. |
Provisioned as a public application from the play store. |
|||
COPE |
Personal Profile |
Remote View ONLY Supported |
Android 9.x and 10.x ONLY. |
Provisioned as an internal application. |
||
Work Profile |
Remote View ONLY Supported |
Android 9.x and 10.x |
Provisioned as an internal application. |
|||
Android 11.x and later. |
Provisioned as a public application from the play store. |
Which Profile/Ownerships Work with Samsung Knox
Only certain combinations of Android and Knox plugin versions with device ownership and profile types are compatible to make devices work with Workspace ONE Assist.
Android 8.0 with Knox versions earlier than 3.4.1 |
Android 9.0 with Knox versions earlier than 3.4.1 |
Android 10.0 with Knox 3.4.1 or later |
Android 11.0 with Knox 3.4.1 or later |
|
---|---|---|---|---|
Work Profile |
Not supported - Knox Service Plugin is not available. |
Supported by enabling remote control within Profile Owner using the Knox Service Plugin and Premium Knox License. See How Do You Enable Remote Control with Samsung Knox Service Plugin. |
Supported - remote control is enabled on the work profile by default. |
Supported - remote control is enabled on the work profile by default. |
Premium Work Profile |
Not supported - Knox Service Plugin is not available. |
Supported by enabling remote control within Profile Owner using the Knox Service Plugin and Premium Knox License. See How Do You Enable Remote Control with Samsung Knox Service Plugin. |
Supported by enabling remote control within Profile Owner using the Knox Service Plugin and Premium Knox License. See How Do You Enable Remote Control with Samsung Knox Service Plugin. |
Supported by enabling remote control within Profile Owner using the Knox Service Plugin and Premium Knox License. See How Do You Enable Remote Control with Samsung Knox Service Plugin. |
COPE (personal side) |
Supported - Assist pushed as an Internal app to the personal side can view and control the screen within the personal space ONLY. |
Supported - Assist pushed as an Internal app to the personal side can view and the control the screen. |
Supported - Assist pushed as an Internal app to the personal side can view and control the screen. |
Not supported - Assist app can ONLY be installed within the Work Profile through the Managed Play Store and cannot view or control the personal side. |
BYOD (personal side) |
Not supported - Assist app can ONLY be installed within the Work Profile through the Managed Play Store and cannot view or control the personal side. |
Not supported - Assist app can ONLY be installed within the Work Profile through the Managed Play Store and cannot view or control the personal side. |
Not supported - Assist app can ONLY be installed within the Work Profile through the Managed Play Store and cannot view or control the personal side. |
Not supported - Assist app can ONLY be installed within the Work Profile through the Managed Play Store and cannot view or control the personal side. |
Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android
Your Android device can enjoy full remote control support for Workspace ONE Assist if its model is listed here and you have installed its OEM-specific service application, available at the My Workspace ONE ™ documentation repository.
Workspace ONE Assist supports the following versions of the Assist service application:
Version 2.3
Compatible with Assist agent version 5.2 and above.
Enables Remote view and control capabilities on Android devices.
Enables Key injection on Android devices (ability to pass in values from a remote keyboard).
Enables File manager capabilities on the android devices.
Version 2.5
Compatible with Assist agent version 5.2 and later.
Enables remote view and control capabilities on android devices.
Enables key injection on android devices (ability to pass in values from a remote keyboard).
Enables File manager capabilities on the android devices.
Enables remote reboot with auto-reconnect on android devices.
Supports scoped storage on android 11 devices without end user input.
Version 3.0
Compatible with Assist agent 22.03 and later.
Compatible with Android 12 and later.
We can continue to use version 2.5 for Android 11 and earlier devices with the 22.03 Assist agent.
Version 3.1
Compatible with Assist agent 22.03 and later.
Compatible with Android 13 and later.
We can continue to use versions 2.5 or 3.0 for Android 11 and earlier devices with the 22.03 Assist agent.
With Assist 21.09, Android devices running Android 7.1 and later no longer require a OEM-specific service application to be installed to support full remote control. For full remote control, end users must provide additional permissions such as:
Enable screen share for every session on Android 10 and later.
Enable accessibility service for each remote control session.
Note:Accessibility service cannot be enabled within a Work Profile, hence, remote control using Accessibility service cannot be leveraged on COPE and BYOD devices.
OEM Models |
||
---|---|---|
|
|
|
Capabilities by Platform
You can review all the major supported features of Workspace ONE Assist separated by platform.
Android |
iOS |
macOS |
Windows CE |
Windows Desktop |
Linux |
|
Activity Log(accessed from the app) |
✓ * |
✓ |
✓ |
|||
Attended Mode (BYOD/COPE) |
✓ |
✓ |
✓ |
✓ |
||
Capture images or video |
✓ |
✓ |
✓ |
✓ |
✓ |
|
Chat Messaging |
✓ |
✓ |
✓ |
|||
Control device buttons and keypad |
✓ |
✓ |
||||
Manage files and folders |
✓ |
✓ |
✓ |
✓ |
✓ |
|
Multi Monitor Support |
✓ (Zebra only) |
✓ |
✓ |
|||
On Screen Notifications and Controls (Halo) |
✓ * |
✓ |
✓ |
|||
Registry editor |
✓ |
|||||
Remote control |
✓ |
✓ |
✓ |
✓ |
||
Remote view |
✓ |
✓ |
✓ |
✓ |
||
Remote reboot with auto reconnect |
✓ |
✓ |
✓ |
✓ |
||
Role-based access to client tools |
✓ |
✓ |
✓ |
✓ |
✓ |
|
Run commands |
✓ |
✓ |
✓ |
✓ |
||
Screen draw |
✓ |
✓ |
✓ |
|||
Screenshot Capability |
✓ |
✓ |
✓ |
✓ |
✓ |
|
Screen Recording |
✓ |
✓ |
✓ |
✓ |
✓ |
|
Shortcuts to commonly used apps and settings |
✓ |
✓ |
✓ |
✓ |
||
Session Collaboration |
✓ |
✓ |
✓ |
|||
Unattended mode (Rugged/Kiosk) |
✓ |
✓ (Corporate Owned devices only) |
✓ |
✓ |
✓ |
|
View and export device info |
✓ |
✓ |
✓ |
✓ |
✓ |
|
View list active processes and apps |
✓ ** |
✓ |
✓ |
✓ |
||
Virtual on-screen keyboard |
✓ |
✓ |
✓ |
✓ |
||
Clipboard |
✓ |
✓ |
||||
Audit Logging |
✓ |
✓ |
✓ |
✓ |
✓ |
|
* Attended Mode only ** Android 6 and earlier only |