VMware Workspace ONE® Assist allows VMware Workspace ONE® UEM administrators to remotely access and troubleshoot devices in real time while respecting end-user privacy.
Workspace ONE Assist Release Notes describe the new features and enhancements in each release. This page contains a summary of the new capabilities, issues that have been resolved, and known issues that have been reported in each release over the last 18 months.
Reduced latency and improved real-time streaming experience for Windows devices
Workspace ONE Assist now supports improved streaming and controls for windows devices during a screen share session by leveraging hardware acceleration and efficient adaptation algorithms.
Improved remoting experience includes:
Hardware accelerated video codec.
Dynamic video codec negotiation.
Adaptive bitrate based on measured network parameters.
Improved resiliency of enrollment flows for Assist Android agent
Workspace ONE Assist now supports detailed enrollment health check and retry mechanism in Android devices. With this enhancement, any failures that can be mitigated are handled without any manual interventions. Event logs within the UEM console now provide consistent enrollment status (Success/Failure).
Android devices require Workspace ONE Intelligent Hub 23.09.
Support for fine gesture controls on Android that allows actions like drag/drop, pattern unlocks, and long presses
Workspace ONE Assist now supports fine gesture controls on Android that allows actions like drag/drop, pattern unlocks, and long presses. With this enhancement, admins can now unlock devices remotely through an Assist session to continue troubleshooting or maintenance.
Expanded support for Unattended mode across all Corporate owned Windows devices
In this release, we have expanded the support for unattended mode on all corporate owned Windows devices. Windows devices with Azure AD or Domain joined is no longer a requirement for unattended screen share sessions.
Windows devices must have Intelligent Hub v23.10.
To perform an unattended session, start the remote support session with the screen share tool. Starting a session with the file manager or remote shell tool will default the session to attended mode.
Support for unattended remote control on Motorola devices with the OEM configuration
Assist leverages the Google screencast APIs and accessibility permission to provide remote control capabilities on Motorola devices which often requires manual interactions to grant permissions which is not ideal for unattended use cases.
With this release, we are adding support for remote control using the OEM configurations available through the 'Moto OEMConfig' application.
Minimum requirements:
OS 13
Moto OEMConfig v13.03.0320 or later
Configurations for Moto OEMConfig application:
Activate 'Managed Access' in application configuration.
Activate 'Display over the other app settings' and add package name 'com.airwatch.rm.agent' (UEM resource portal) or 'com.airwatch.rm.agent.cloud' (playstore version) based on use cases.
'Grant Access' for 'Remote Control'.
com.airwatch.rm.agent:
Grant Access: True
Package Name: 'com.airwatch.rm.agent' (UEM resource portal)
App Certificate: 54:BF:43:56:6C:CE:2A:53:3A:F0:85:E1:FB:B7:92:61:9D:B9:3E:D0:C2:DB:0C:A6:FA:D8:90:87:3F:9A:C2:90
com.airwatch.rm.agent.cloud:
Grant Access: True
Package Name: 'com.airwatch.rm.agent.cloud' (Playstore version)
App Certificate: D2:4E:43:63:C4:1F:A7:08:55:1B:EA:4E:F4:27:4C:DF:FA:F3:80:01:D4:C1:0A:89:30:BA:4B:AA:2F:4F:47:35
Known Issues:
Single laptop keyboard injections are injected twice. Example – ‘a’ is injected as ‘aa’
Key combinations are not functional. Example – ‘Shift + a’
Support for Android 14
Announcing support for Android devices running OS 14.
Support for iOS 17 and iPad OS 17
Announcing support for iOS and iPad devices running OS 17.
Support for macOS 14
Announcing support for macOS devices running OS 14.
AET-8958: Android - During session collaboration, participant list on device is blank.
AET-11526: macOS - "A monitor has been unplugged from remote system" message is seen in the console after recovering from a reboot DR though monitor wasn’t connected and unplugged.
AET-13523: macOS - Screen recording shows two Assist core permissions.
AET-13632: Android Assist app notification shows empty content
AET-13956: Windows - Black screen/capture is seen when connecting to a share screen session.
AET-14067: macOS - macOS 23.07 fails to connect on VPN.
AET-14126: macOS - Process Name shows 'Not Available' while connected with Assist.
AET-14143: Windows - Multi monitor icon is seen even after disconnecting the monitors in an active session.
Enhanced streaming performance in iOS devices
Workspace ONE Assist now supports enhanced streaming quality and performance in iPhones & iPads during a screen share session across all supported browsers. With this enhancement, memory usage on the remote device sees a reduced load. No additional configuration is required, but needs updated iOS Assist SDK which is bundled with iOS Hub (more details on version of Hub will be made available in the Hub release notes).
Support for dynamic shortcuts to Work Profile applications from the Assist console
On Android devices enrolled in Android Enterprise COPE mode, remote control functionality is only available within work profile applications, when the application is in foreground. However, the admin cannot navigate around the device until the end user on the remote device manually launches each application that might need troubleshooting.
In this Assist release, we have implemented the capability on the Assist agent to retrieve the list of apps installed on the work profile side of the device enrolled in COPE mode and list them in the Shortcuts tool window of the Assist Console. This will help the admins to easily access these shortcuts and navigate around the device during troubleshooting.
Enhancements to the UI/UX in the Remote Assist console
Experience enhanced discoverability of value-added Assist features such as Shortcuts, Whiteboard, and so on, which are now readily visible in the toolbar and can be accessed with a single click. We have also made improvements to the Assist console UI to provide the admins with a more consistent and seamless experience.
Support for Remote Assist sessions on Proxy enabled MacOS machines
We have added support for Assist sessions on MacOS machines that are configured for proxy with authentication. In our earlier Assist releases, remote assist sessions were failing to connect on MacOS machines that had the proxy setup.
Support for Remote View Only in Android Unattended mode
Remote Assist session with the Unattended mode in Android always provided the Admin with full remote control capability even if the admin role in UEM did not have the Remote Control permission enabled for Assist.
In this Assist release, we have implemented the role validation even when Unattended mode is used in Android. So, if the admin does not have the Remote Control permission for Assist then the session would default to Remote View and Remote Control capability will not be available.
Support for Database Name Modification & Password reset for local SQL User accounts
For On-Premises customers using Assist, we have introduced the ability to modify the Assist Database names (for new deployments). In addition, we have also provided the ability to enforce password policy for the local SQL user accounts created through the Assist installer. We will also be sharing a standalone tool to reset the passwords of the SQL user accounts after they expire.
Support for Unattended mode on Windows 10 IOT Enterprise OS version
Remote Assist sessions were defaulting to Attended mode on the Win10 IOT Enterprise OS versions that had the OperatingSystemSKU value as 188. In this release, we have added support for Unattended mode on these OS versions as well.
Integration with UEM SYSLOG for logging, monitoring and reporting Assist events
We introduced the Audit Log functionality in the previous release of Assist (v23.02) where in any actions performed by the admin in the remote session was recorded and sent to the UEM Event logger and can be exported to the Syslog.
In this Assist release (v23.07), we have made some enhancements to this implementation and also included some more admin actions that will get logged.
Listed are some of the newly included actions and enhancements.
Whiteboarding events.
Consistent event formatting in Android to be at par with the other supported platforms.
Please note that Assist will not collect any PII information as part of the event logging.
UEM syslog feature is available with UEM 2302 or later, but these enhancements are available with UEM 2310 or later.
The AssistOAuthProvisioningFeatureFlag should be set to TRUE in the UEM DB.
To request for the FF to be enabled in your environment, submit a ticket through the following link: https://servicedesk.eng.vmware.com/servicedesk/customer/portal/21/create/1413
Assist console logging improvements
To make the troubleshooting smoother, we have improved our console logging. Admins or Support personnel can now see the logs automatically if there is an error. API URLs are added to the logs for both success and failure. Error code is now captured in the logs for web socket failures and logs are automatically opened after first failure.
AET-3387: The Whiteboard cursor action performs double click instead of single click.
AET-3997: Assist - Win10 - Domain Joined/Azure AD - Session could not be paused from floatella /in session record when the DR happened while the RC elevation prompt is in foreground.
AET-4018: Chat console UI does not scroll automatically.
AET-4019: Assist - Win10 - Session Collaboration - Guest tool bar active and clickable though the Session is terminated prompt is seen in foreground.
AET-4021 : Assist - Chat - Console - When the chat message is typed and sent, a new line is created in the input box.
AET-4119: Assist - Chat - Android - Chat messages status on console always shown as sending.
AET-4150: Assist - Session Collaboration - Shortcut tray is shifted and partially overlapped by device info when guest session is added.
AET-4151: Assist - Session Collaboration - When guest has session control, device info panel disappears from host console when recovering from DR.
AET-4257: Assist - Session Collaboration - App List/Process List pages keeps loading in Host session when Guest has the session controls.
AET-11111: Sometimes, while starting the remote session, the connection fails in the first console connection step.
AET-11376: WS1 Assist 23.02 Installer Resource pack execution failed when password created with double quotes (") character.
AET-11377: Assist service version is not updated with the released version.
AET-12601: CFD - WS1 Assist Console – The message 'The connection closed abnormally' is seen at the first connection attempt from the customer end with Assist Server RMUK01.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
Integration with UEM SYSLOG for logging, monitoring and reporting Assist events
This feature is in a Limited availability state. Take a look at the listed items that can help you activate this feature:
UEM version 2302 which is expected to GA on March 22nd 2023.
The Feature Flag (FF) 'AssistOAuthProvisioningFeatureFlag' needs to be enabled.
To request for the FF to be enabled in your environment, submit a ticket through the following link: https://servicedesk.eng.vmware.com/servicedesk/customer/portal/21/create/1413
All the actions performed by an admin in a remote assist session are now logged for security auditing purposes.
In line with this need, we have implemented the Audit Log functionality where in any actions performed by the admin in the remote session will be recorded & sent to the UEM Event logger and can be exported to Syslog.
Some of the actions that may be logged are mentioned below.
Session events such as Authentication Requests, Session Elevation from Remote View to Remote Control, and so on.
PIN authentication and response (If Attended mode of connection)
Tool Connected and Duration
Shortcuts used during the session
Pause/Resume actions by the end user
Clipboard transactions
Chat transactions between admin and end user
File Manager Events (File/Folder Cut, Copy, Paste, Upload, Download)
Remote Shell command executions (in Windows & MacOS)
Command Line Interface command executions (in Android)
Session end (Contains all details about the session: Data Size, Connection Mode, UEM Admin User, Assist Server URL, Session Duration, Status, Assist Agent version, and so on.)
Assist will not collect any PII information as part of the event logging.
UEM 2302 or later is required to support this feature.
The AssistOAuthProvisioningFeatureFlag must be set to TRUE in the UEM DB.
This feature is currently available only for SaaS Assist customers.
Enhanced streaming performance with VP8 Encoding for Android devices
Workspace ONE Assist now supports VP8 encoding on Android devices to enhance streaming quality and performance during a screen share session across all supported browsers. With the support for VP8 encoding, memory usage on the remote device will also see a reduced load. VP8 encoding is enabled by default and does not require any additional configurations.
Support for Remote Control in Motorola LEX 11 devices with Motorola APIs
Remote Control is now supported in Motorola LEX 11 devices. The Assist agent will leverage Motorola provided APIs to support remote control functionality within Assist.
All functionalities that exist within Assist including touch and key injection events will be now available through the Motorola remote management APIs.
Supported LEX L11 Firmware version – Starting from Android 11 release R3.3 (R40.33.10)
Support for Unattended Mode of Remote Session in MacOS
Workspace ONE Assist is introducing the ability to remotely connect to and control MacOS devices that are corporate owned, with no personal data or user expectation of privacy and that business needs to access without approval from a remote user.
The following types of devices support Unattended Privacy Mode:
Corporate Owned – Dedicated
Corporate Owned - Shared
Employee-Owned devices support only the Attended mode which mandates authorization from the remote user.
On the MacOS platform, a single Assist application supports both Attended and Unattended Privacy modes. The 'Unattended Access' permission/resource in the Workspace ONE UEM - > Role Management, under the Assist section determines which UEM console user has the ability to use Unattended access to devices. This resource is applicable for both Windows Desktop and MacOS platforms.
The Console User is presented with both the Attended & Unattended options during the connection process from which they can choose the privacy mode.
On-Screen notification and Screen controls (Halo) will be displayed on MacOS Unattended mode when the user is logged in.
Support for viewing and controlling external monitors connected to Zebra devices using the Workstation Connect Cradle or Connect Hub
Zebra devices that are connected to external monitors through the Workstation Connect Cradle or Connect Hub can now be viewed and controlled through the remote session.
The Multi-Monitor button appears in the admin console when the Zebra device has an external monitor connected. It allows the admin to switch between the displays they want to view or control. Please note that only one monitor may be viewed or controlled at any given time.
Pre-Requisites:
The Zebra device should be connected through the docking station. The docking station should be connected to the monitor through HDMI cable.
The 'Force Desktop Mode' option should be enabled under Settings → Developer Options.
Zebra WorkStation connect application should be installed and 'Display Over Apps/Appear on Top' permission needs to be enabled.
For non-tablet devices, we need to enable the DisplayDesktopOEM [com.displaylink.desktop.oem] application through profiles. By default, UEM may disable all system apps.
Make sure the device is restarted after the above settings are configured.
The supported firmware version is 11-31-27.00-RG-U00-STD-HEL-04 or later.
Supported device models are EC50, EC55, ET51, ET56, L10A, TC21, TC21 HC, TC26, TC26 HC, TC52, TC52 HC, TC57, TC72, TC77.
Improved reliability of Assist connections in Windows & MacOS platforms
When an Assist session is started by an Admin from the UEM console, the connection is established with the remote device automatically. However, assist sessions sometimes end in request timeouts due to various factors. One of the common reasons for this is due to Hub not processing the Remote Management command in time to wake up the Assist agent on the device.
To prevent these request time outs, we have introduced an alternate mechanism to invoke the Assist agent on the device. This is achieved by sending a notification from the Assist Console/Server to the device using the Windows Notification Service (WNS) and the Apple Push Notification Service (APNS).
This ensures that Assist agent doesn't always rely on the Hub to get invoked. This in turn will improve the reliability of Assist connections by significantly reducing the timeouts.
This feature is currently available only for SaaS Assist customers. No additional configuration is required on the device side to enable this feature.
Updated Privacy verbiage & Terms and Conditions verbiage on PIN entry screen in device
We have updated the verbiage displayed on our Privacy screen & the Terms and Conditions screen during the PIN entry process to be more relevant to the interaction between the Customer IT/Help Desk Org and the employees of the customer.
In some Android devices, the VP8 encoder does not support 100% zoom in of the device screen in a remote session. When 100% is requested, the admin console zooms in the device screen only up to the maximum supported by the device hardware.
In Android devices, when the Assist agent 23.02 is used on Assist consoles earlier than 23.02 version, streaming may be interrupted and a grey screen shown on the admin console when any of the following actions occur in the remote session.
Resizing of Browser window.
Toggling ON/Off the Fit to Screen option.
Collapsing the Device Summary panel.
AET-11449: In Unattended mode on MacOS, the session terminated automatically when connection was performed with the device locked.
AET-11360: Ctrl+Alt+Del shortcut does not work as expected on Windows desktops when the device is in locked state.
AET-11167: In Windows desktops, the CPU Utilization Percentage in the Process List page of Assist session always shows 0%.
AET-10918: Using the Buzz icon during a Chat from the admin console does not send sound alert or vibration to the Android device.
AET-11095: Remote Connection fails on Sony devices with the last GA version of Assist agent.
AET-11144: Remote Connection fails when a private APN or Wi-Fi is used with proxy configuration.
AET-11318: Remote Connection failing in Android devices when using a proxy over HTTP in with Assist 22.10 agent.
AET-11473: Some File Manager events are not captured as part of the event logging in Windows and MacOS platforms
AET-11286: In Zebra devices with an external monitor connected, the remote session may stop streaming when switched multiple times between the primary and secondary displays. The current workaround is to end the session when this happens and initiate a new session.
Support for Bi-directional Clipboard functionality for Windows & MacOS
Support for Remote Assist session when no user is logged in to the device
Security Enhancements
AET-10162: macOS Assist agent does not get installed if device is at Login window.
AET-9101: Remote Assist session fails on Windows devices having Null or Dummy Serial Number though the device UDID is unique across these devices.
AET-10304: Remote Session Initiation gets stuck at step 4 in Lenovo X13 or T14 windows 10 10.0.19044 21H2 Enterprise LTSC laptops if the device is locked.
AET-10520: Unable to connect to Screen Share or File Manager tool for the second time within an ongoing Remote Assist session after disconnecting from these tools the first time.
AET - 10518: Command Line window gets partially truncated after exiting from full screen mode.
Bug Fixes and Security Enhancements
Enabled secure Remote Control on Android devices on the proxy network.
Changed APIs to use the POST method instead of the GET method to avoid phishing attacks.
Simplifying provisioning of Unattended Samsung devices by allowing the Knox EULA permission to be accepted during Assist app installation
To simplify the provisioning of the Assist application on a Samsung device used for Unattended purposes, the KNOX End User License Agreement can be accepted by the IT administrator at the time of app installation. Prior to Assist 22.04, the Samsung KNOX EULA permission was prompted during the first Remote Control session. This was an issue for unattended use cases where there were no users at the device end to accept permissions.
In Assist 22.04, on Samsung devices using the unattended Assist agent, the permissions will be prompted when the Assist application is installed. If the permission is not accepted during installation, permission is requested during the first remote control session.
Assist Attended mode will continue to request this permission during the first remote control session.
Introducing key-board shortcuts along with on-screen instructions to copy/paste within the Remote Shell tool
The Workspace ONE Assist Remote Shell tool is commonly used to troubleshoot and run commands on the remote device. One common action performed during the remote shell session is to copy/paste commands and other text to and from the remote device. To simplify the use of the tool, we have added keyboard shortcuts and provided on-screen guidance to access these shortcuts.
When a Windows device is used to access the Assist console, the commands to copy and paste are Ctrl+Insert and Ctrl+Shift+V. On a macOS device, the commands to copy and paste are Cmd+C and Cmd+V
Streamlined User Experience for accepting Permissions prompts on Android attended mode
On Android devices used in attended mode and for which we do not have an OEM signed Assist service application, there are multiple user permissions requested to provide a complete remote-control experience. End-user interactions include a one-time 4-digit PIN entry per session, granting a screen cast permission to allow the remote view of the device screen, granting a draw over apps permission that facilitates the Whiteboard feature, and granting the accessibility permission to allow remote control within the device. On Samsung devices, there is an additional one-time KNOX EULA request that has to be granted by the user.
From Assist 22.04, to simplify and streamline the experience, there is a single information page displayed on both the device and the admin console, which provides information about the necessary permissions and the instructions to grant these permissions. The UI on the device will also automatically navigate the user to accept these permissions one by one.
Remotely View the entire device screen on Samsung COPE
On Samsung Android 11 and later devices enrolled on Android Enterprise COPE mode, remotely view the entire device, and remotely control work profile applications to provide optimal support to your employees.
Prior to Assist 22.04, Remote View and Control were only supported within the work profile applications due to Knox restrictions. Since the home screen and the application launcher screen within the work profile tab is also considered personal, Assist was able to provide remote view and control capabilities only after the application was manually launched to the foreground by the end user. From Assist 22.04 onwards, the entire device can be remotely viewed, including the home screen, settings, and all other screens on the work profile on Samsung devices.
Introducing Support for Workspace ONE Assist on Workspace ONE UEM Registered devices
Deliver a consistent remote support experience across managed and unmanaged devices with Workspace ONE Assist. Prior to this release, Assist was supported only on Workspace ONE Hub managed devices for Android and iOS platforms. In Assist 22.04, we have introduced support for devices enrolled to UEM in hub registered mode. Administrators can now perform screen share sessions on iOS, file manager, and command-line sessions on Android devices registered to Workspace ONE UEM.
Note: Workspace ONE Assist is already supported on Windows 10/11 devices registered to Workspace ONE UEM.
We are always working to improve Workspace ONE Assist with every release. There are no major bug fixes to report.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
Introducing Assist Service application version 3.0 to support remote control on Android 12 devices.
Download the OEM-specific service app v3.0 from the My Workspace ONE portal to support full remote control on devices running Android 12 and later. On devices running Android 11 and earlier, you can use the Assist service application v2.5 or the newly released v3.0.
For m1 macs with apple silicon, there is no need to separately install Rosetta2
Before 22.03, for all M1 macs with Apple silicon, Rosetta2 had to be installed separately to ensure the proper functioning of Assist. With the 22.03 version, we have included Rosetta2 in the assist package itself thus avoiding the need to install Rosetta2 separately.
Improved reliability of Assist connection in attended mode
When an Assist session is started by an Admin from the UEM console, the connection is established with the remote device automatically. However, Assist sessions sometimes end in request timeouts due to various factors including network issues. To prevent these request time-outs, you can now request the end user to manually launch the assist application from the device after the connection has started on the UEM Console. This additional step is not mandatory and is only available to improve reliability and speed up the Assist connection process.
AET-7742: The session started correctly on Zebra Android 11 devices with the Assist 2109 agent, but the screen streaming did not happen. This bug is resolved in the 22.03 release.
AET-7707: Prior to 2203, when the Android endpoint language was set to traditional Chinese, the confirmation page where the user entered the pin did not have the Agree button at the bottom. This has been resolved in the 22.03 release.
AET-7674: The macOS agent of Assist v21.09 had a bug that showed an error message while launching any application on the device with the Assist app installed. The assist app had to be removed from the device to launch applications in the device. This bug has been resolved in the 22.03 version.
AET-5141: The Assist agent previously crashed when a non-asci character was sent in chat on macOS devices. This has been resolved in the 22.03 release.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
Enforcing RBAC on Session Collaboration feature
A new resource called Session Collaboration has been added to Administrator Roles within Workspace ONE UEM under the Assist category. This resource enables or disables the Session Collaboration feature which provides the ability to invite additional participants into a session within the Assist console.
Introducing the ability to switch user accounts during a remote session
You can now switch user accounts during an active remote-control session without getting disconnected from the session. Assist also allows remote control of the login screen that enables you to log in using other user credentials.
Introducing Automatic Reconnection on Reboot
Improved admin experience now allows automatic reconnection during device reboots. This functionality was previously available only on Android and Windows devices. You can now reboot a macOS device during a remote-control session and automatically reconnect back without end-user assistance. If File Vault2 is enabled, the admin will be instructed to perform additional steps and provide login credentials prior to the reboot.
Introducing Attended mode on Kiosk and LTSC Devices
Previously, for devices set to Kiosk mode or Windows 10 Enterprise LTSC, the Assist session always defaulted to Unattended mode. As a result, privacy centric customers who required end user authentication on these Windows 10 devices, could not perform remote sessions in Attended mode.This release introduces support for attended mode on Kiosk and LTSC devices. The admin experience during the remote session is determined by the UEM Role assigned. If the admin has unattended mode disabled, then the session will always be attended. If unattended mode is enabled, the admin has the option to choose privacy mode during the connection process.
Enhancements to Auto-Proxy Discovery
Customers with Basic authentication proxy settings enabled can now perform Assist sessions by entering proxy credentials one-time at the start of the first session. All subsequent connections will not require an end user to enter proxy information again.
Enhanced performance using VP8 encoding
Workspace ONE Assist now supports VP8 encoding on win10 devices to enhance streaming quality and performance during a screen share session across all supported browsers. With the support for VP8 encoding, Memory and CPU usage on the remote device will also see a significant improvement. VP8 encoding is enabled by default and does not require any additional configurations.
Introducing Attended Remote Control on Android devices without OEM specific service application
Prior to Assist 21.09 release, for remote control on Android devices, Assist required the installation of an OEM-specific service application. An exception to this was Samsung, Sony, and Zebra (Android 11+) devices. But with Assist 21.09 release, customers can now remotely control Android Enterprise enrolled fully managed devices without the need for an OEM-specific service app.
Note: This is supported on Devices with OS version 7.1+ (Android N+). This will require the following additional end-user permissions.
Accessibility Permission: This is one-time permission that needs to be enabled by the end-user at the start of the first session.
Screen share: This needs to be enabled by the end user for every session on Android 10 or later.
Accessibility service cannot be enabled within a Work Profile. As a result, Remote control using Accessibility service cannot be leveraged on COPE and BYOD devices.
AET-6293: [Security Enhancement] Servers have been reconfigured to not expose any information about its make, version, or OS to avoid Banner Grabbing.
AET-6596: [Security Enhancement] Open redirection of URL strings has been restricted to avoid XSS attacks.
AET-6497: On the Samsung A52 device, a black screen showed on the Assist console during the remote session has been resolved.
AET-6252: Sonim XP8800 on Android 8 could not establish Remote Session and showed “Request Timeout.” This issue has been resolved.
AET-6200: In kiosk mode, Windows 10 devices, there was a delay in sending GET messages by the Win 10 agent, due to which the remote session got stuck at the authorization screen. This issue has been resolved.
AET-5924: Session idle time out has been implemented for View only mode in Android devices.
AET-5407: In Assist Android File Manager previously, we could not download a folder while it was in Internal Storage. In this release, we can download the folder in internal storage from the Android Assist file Manager.
AET-4754: When the device is set to the Turkish language, the Device EMM ID value was case sensitive and, as a result, parsed incorrectly and not recorded in the DB. Hence, the device was not registered in the console, and the user could not find the device. This issue is resolved in Assist 21.09.
AET-6597: [Security Enhancement] Executable and DLL files have been digitally signed to avoid tampering and reverse-engineering attacks.
AET-6237: [Security Enhancement] Configurable idle timeout times have been set for all roles so that attackers cannot exploit session ID vulnerability.
AET-6230: [Security Enhancement] Sensitive information has been moved to be passed from the HTTP post method instead of the query string so that it is not exposed.
AET-5388: [Security Enhancement] For the Win10 client, the enrolment information file has been moved to a location where only the specific user account has access to the information to avoid identity theft.
AET-6873: If admin ends one tool and leave others connected during the Disaster Recovery state at internet interruption then the Console does not connect back to the Screen Share tool when the internet connectivity is restored. Hence, it is suggested to end all the tools connected during an internet interruption and start afresh rather than ending just the screen share tool.
On macOS devices, only the English keyboard is supported on the login screen after reboot.
In this release, we’ve made a few updates containing general quality and performance improvements with no new features.
AET-5561: Workspace ONE Assist service connection failure when Workspace ONE UEM is upgraded to 2105 version.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
Support for X-frame-Options header value set to DENY
In previous versions of Assist, if the X-frame-Options header value is set to ‘DENY’ rather than ‘SAME-ORIGIN’, the file manager functionality within Assist was impacted causing failure in file downloads. WS1 Assist now supports the X-Frame-Options header to be set to value ‘DENY’. The Workspace ONE Assist installer will still always set the X-frame-options header to ‘SAME-ORIGIN’ by default. However, if there are existing configurations setting it to value ‘DENY’, the Assist installer will not overwrite it.
Fixes to chat notification on Android
In-session chat was introduced as part of the 20.11 release on Android, macOS, and Windows 10 platforms. On Android alone, the chat notifications were failing. This issue is now fixed in this release.
Support for Android 11 on Zebra devices
Starting Android 11 and above, the Assist agent will leverage Zebra provided APIs to support remote control functionality within Assist. On Android 11 and above, the Assist service application will not be used. As a result, newly enrolled devices do not need the service application to be installed on them. On previously enrolled devices upgrading to Android 11, the Assist service application can be uninstalled if previously installed.
All functionality that existed within Assist by leveraging the Assist service application will be now available through the Zebra remote management APIs.
Support for Scoped Storage on Android 11
In Android 11, Google is enforcing scoped storage on all applications targeting API level 30. With the enforcement of scoped storage, an application is limited to only accessing its own file sandbox and specific types of media files that the app has created. To access other file locations on the device, the remote user must explicitly grant permissions to the application requesting it.
Assist is working with partner OEMs to provide a new version of the Assist service application (v2.5) that will automatically grant all file access during a remote file manager session. The latest version of the Assist service application can be downloaded from the Resource Portal in My Workspace ONE.
On OEMs where Assist does not have a service application (for example, Samsung, Sony, and Zebra Android 11 devices), to provide full file access, Workspace ONE Assist will prompt the remote user to “Allow access to manage all files” permission on Android 11. This permission needs to be granted to the Assist application one-time at the beginning of the first File manager session. On the Attended mode, this permission can be granted by the remote user of the device. On Unattended mode, this permission will need to be granted by the Console User through the Screen Share tool. Instructions to grant this permission will be displayed on the Assist console UI during a file manager session.
Once this permission is granted, all files on the remote device can be accessed through the File manager. In the absence of this permission, the Console user has limited file access to the Media and Downloads folder only.
Enhanced performance using VP8 encoding
Workspace ONE Assist now supports VP8 encoding on macOS devices to enhance streaming quality and performance during a screen share session across all supported browsers. With the support for VP8 encoding, Memory and CPU usage on the remote device will also see a significant improvement. VP8 encoding is enabled by default and does not require any additional configurations.
Other Security Enhancements.
AET-4189: Security Improvements to provide protections against Clickjacking.
AET-4188: Security Improvements to prevent sensitive information about the application or its components from being inappropriately disclosed to the users.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
Enhanced Reliability of Session Initiation
To improve the reliability of connections on Assist sessions, a direct notification channel exists between the Assist server and Assist agent on the remote device. The Android Assist agent receives a Firebase Cloud Message directly from the Assist server during the connection process, minimizing request timeouts and improving the overall experience.
On customer environments that have closed networks, additional endpoints must be accessible on the remote user’s device to receive Firebase Cloud Messages. Refer to docs.vmware.com for more details on the end points.
Introducing additional shortcuts on the Windows 10 platform to enhance the Console User experience.
Shortcuts provide one click access to commonly used settings & functions on the remote device and helps reduce the average handling time needed to troubleshoot device issues & provide support. The following additional shortcuts are available in this release.
Ctrl-Alt-Delete.
Lock screen.
Log out of device (with a confirmation prompt).
Furthermore, the shortcut menu can be pinned to the screen. This ensures that the shortcut menu does not need to be reopened each time a new shortcut is accessed.
Introducing in-session Chat
To facilitate better communication during an Assist session, Workspace ONE Assist introduces Chat for Windows 10, macOS, and Android devices. The Chat functionality can be used for communication between the console user initiating the session, all participants collaborating on the session, and the remote user on the device.
Chat can be accessed on the Assist console from the tool bar menu and can be used to send text messages to all participants in a session. You can also send private text messages to individual participants and the remote user.
Chat can be used during an Assist session regardless of the tool being used. For example, if only a Manage Files session is initiated with the remote device, Chat is still accessible.
On the remote device, Chat messages can be accessed from within the Chat tab in the Assist application. The Chat tab is available on both Attended and Unattended modes. The end user is notified about new messages only in Attended mode.
Introducing Session Collaboration
When providing efficient troubleshooting and support to end users, sometimes it is necessary for help desk and IT admins to collaborate with other subject matter experts. For example, higher tiers of help desk and engineering resources. Workspace ONE Assist introduces Session Collaboration to facilitate multiple console users to collaborate with each other by enabling them to remotely view and control the same device.
Session Collaboration is available on Windows 10, macOS, and Android devices.
The primary console user who initiates an Assist session (Host) can invite other participants to join the session by sharing a Session Invitation by Chat or email. These additional participants (Guests) can remotely view the same device and draw over the device using the White Board tool provided within Assist.
A Guest can also request permission from the Host to control the remote device. Once permission is granted, the Guest can control the remote device and access other limited tools like White Board, Shortcuts, and the Virtual Keyboard.
Note: Certain capabilities like the ability to invite additional guests to a session, manage files, run commands remotely through Command line, or the Remote Shell tool, Screen Recording, Screenshots, and Ending a session is limited to a Host of the session.
Introducing Unattended Mode on Windows 10 devices
You can now remotely connect to and control Win10 devices that are corporate owned with no personal data nor user expectation of privacy without approval from the remote user.
The following types of devices support Unattended Mode.
Windows 10 devices locked to Kiosk Mode.
Windows 10 Enterprise Long-Term Servicing Channel (LTSC).
Windows 10 devices connected to the Active Directory.
All other devices support only the Attended mode which mandates authorization from the remote user.
On Windows 10 platform, a single Assist application supports both Attended and Unattended modes. A new resource or permission called “Unattended Access” is available for making new roles by navigating to Accounts > Administrators > Roles and select the Assist category. This resource defines which UEM admin has the ability to select Unattended access to devices. This resource currently applies only to the Windows 10 platform.
On a Windows 10 device locked to Kiosk mode or a Windows 10 Enterprise Long-Term Servicing Channel (LTSC) device, all Assist sessions default to Unattended mode. Once connected, you have full control of the Remote device in both the Admin and Kiosk profiles. However, the following capabilities are unsupported when the device is in a Kiosk profile.
Whiteboard.
Halo (on screen notification and controls).
Shortcuts (with the exception of Ctrl-Alt-Delete, which remains available in a Kiosk profile).
On Domain Joined and Azure AD connected devices, you can choose the privacy mode during the connection process.
If the Attended mode is chosen, the session proceeds to the PIN entry screen as usual.
If Unattended mode is chosen, Assist determines the state of the device.
If the Device is in use, the remote user is prompted to allow connection.
If remote user accepts the connection, device can be viewed and controlled within the local user account.
If remote user denies connection, session is terminated.
If remote user does not respond for more than 30 seconds, Assist locks the device screen. Admins can now login using their own credentials on the remote device and gain control.
If the Device is not in use, connection is established, and you are presented with the Login Screen. You can now login using your credentials and control the remote device.
Note: On-Screen notification and Screen controls (Halo) are displayed on Win 10 devices in Unattended mode.
AET-3246: Installer 20.07 is failing with ‘MgmtSvc not running’ error due to a conflict in the HTTP response header configuration for HSTS Header & X-FrameOptions at the root level on the server.
We haven’t identified any notable known issues in this release. If you’re facing any problems, feel free to reach out to our support team.
To take advantge of the updates, download VMware Workspace ONE® Assist 23.07 from the Resource Portal in My Workspace ONE and follow the included instructions.
For information about Workspace ONE Assist, see the Workspace ONE Assist documentation available at VMware Docs.
For detailed installation instructions, see the Install Workspace ONE Assist chapter of the Workspace ONE Assist documentation.
To receive support, either submit a ticket with the My Workspace ONE portal or call your local support line.
