To control the deployment of applications, add a single assignment or multiple assignments. Also, exclude groups from receiving the assignment.

If you add multiple assignments, prioritize the importance of the assignment by moving its place in the list up for most important or down for least important.

Note: If you use APIs to assign applications, do not use the exclusions in the console. APIs for exclusions are in development at this time. If you want to use exclusions, assign applications through the console, do not use APIs for assignment.
  1. Navigate to Apps & Books > Applications > Native > Internal or Public.
  2. Upload an application and select Save & Assign or select the application and choose Assign from the actions menu.
  3. On the Assignments tab, select Add Assignment and complete the following options:
    Setting Description
    Select Assignment Groups Type a smart group name to select the groups of devices to receive the assignment.
    App Delivery Method
    • On Demand – Deploys content to a catalog or other deployment agent and lets the device user decide if and when to install the content.

      This option is the best choice for content that is not critical to the organization. Allowing users to download the content when they want helps conserve bandwidth and limits unnecessary traffic.

    • Automatic – Deploys content to a catalog or other deployment Hub on a device upon enrollment. After the device enrolls, the system prompts users to install the content on their devices.

      This option is the best choice for content that is critical to your organization and its mobile users.

    Desired State Management


    Currently when installing a macOS software, administrators have an option to enable or disable the Desired State Management settings based on the business needs.

    Desired State Management is enabled by default to enforce application management while installing a macOS software.

    If enabled, and if the end-user deletes the app, the application is automatically reinstalled on the next Workspace ONE Intelligent Hub sync.

    If disabled, and if the end-user deletes the app, the application is not automatically reinstalled, unless pushed from the UEM Console or Catalog. Also, as an administrator you have the flexibility to deploy applications as one-time configuration and provide end-users the facility to uninstall the application locally if needed.

    Deployment Begins On

    Internal Applications

    Set a day of the month and a time of day for the deployment to start.

    The Priority setting governs which deployments push first. Workspace ONE UEM then pushes deployments according to the Effective configuration.

    To set a beginning date with enough bandwidth for successful deployment, consider the traffic patterns of your network.

    Policies - DLP



    Windows Desktop

    Windows Phone

    Configure a device profile with a Restrictions profile to set data loss prevention policies for the application.

    Select Configure. The system navigates to Devices > Profiles. Select Add > Add Profile and the platform.

    • For Android and iOS devices, select Restrictions and enable options in the Data Loss Prevention section.
    • For Windows Desktop, select Device Profile > Restrictions and enable options that apply to the data you want to protect.
    • For Windows Phone, select Restrictions and enable options that apply to the data you want to protect.

    Policies - Managed Access



    Enable adaptive management to set Workspace ONE UEM to manage the device so that the device can access the application.

    Workspace ONE controls this feature and is not supported by the AirWatch Catalog.

    Policies - Remove on Unenroll


    Set the removal of the application from a device when the device unenrolls from Workspace ONE UEM.

    If you choose to enable this option, supervised devices are restricted from silent app installation because the device is locked and the provisioning profile installation is in the command queue which requires a device to be unlocked to complete the installation.

    If you choose to disable this option, provisioning profiles are not pushed along with the installed application. That is, if the provisioning profile is updated, the new provisioning profile is not automatically deployed to devices. In such cases, a new version of the application with the new provisioning profile is required.

    Policies - Prevent Application Backup


    Disallow backing up the application data to iCloud.

    Policies - Make App MDM Managed if User Installed


    Assume management of applications previously installed by users on their devices, supervised and unsupervised.

    Enable this feature so that users do not have to delete the application version installed on the device. Workspace ONE UEM manages the application without having to install the application catalog version on the device.

    Policies - App Tunneling



    Configure a VPN at the application level, and select the Per-App VPN Profile. Users access the application using a VPN, which helps ensure that application access and use is trusted and secure.

    Policies - Application Configuration



    Send application configurations to devices.

    Upload XML (Apple iOS) – Select this option to upload an XML file for your iOS applications that automatically populates the key-value pairs. Get the configurations supported by an application from the developer in XML format

  4. Select Add.
  5. Use the Move Up and Move Down options to order assignments if you have more than one. Place critical assignments at the top of the list. This configuration displays as the Priority.

    The Priority setting takes precedence when there are conflicting deployments assigned to a single device.

  6. Select the Exclusions tab and enter smart groups, organization groups, and user groups to exclude from receiving this application.

    • The system applies exclusions from application assignments at the application level.
    • Consider the organization group (OG) hierarchy when adding exclusions. Exclusions at a parent OG do not apply to the devices at the child OG. Exclusions at a child OG do not apply to the devices at the parent OG. Add exclusions at the desired OG.
  7. Select Save & Publish.

Application configurations are vendor-specific key-value pairs you can deploy with an application to preconfigure the application for users.

For more information about the flexible deployment page, where you can edit schedules for deployments and view settings configured upon upload, see Flexible Deployment for Applications Setting Descriptions.