App Wrapping Requirements

View the supported platforms, bit versions, architectures, console versions, and environments for wrapping apps. Use supported systems to ensure that the solution integrates with your mobile deployment. These requirements also list what app wrapping scenarios and components are not supported so review for caveats.

General Requirements

Supported Platforms and Bit Versions

The application that you wrap must be compatible with the following components. If an application was built with an Workspace ONE SDK older than the version listed, it is not compatible with app wrapping.

Platform Bit Versions and Architectures Supported Workspace ONE UEM Console Version
Android v5.0 or later 32-bit


Note: With the support of 64-bit architectures, expect a size increase of your wrapped Android apps when compared to previous app wrapping releases.
Workspace ONE UEM console v1910 or later
iOS v11.0 or later ARM64 Workspace ONE UEM console v1910 or later

Supported Deployments and Requirements

App wrapping is available for the following deployments, using the SaaS-Hosted app wrapping engine to wrap internal applications. The feature does not wrap public or purchased applications.

Deployment App Wrapping Engine App Type
SaaS Workspace ONE UEM SaaS-Hosted App Wrapping Engine Internal Applications
On-premises Workspace ONE UEM SaaS-Hosted App Wrapping Engine Internal Applications

Store Apps Do Not Wrap

You cannot wrap applications from app stores, even if the APK or IPA comes from the vendor directly. Contact vendors to see if they can incorporate the Workspace ONE SDK and AppConfig into their applications to address enterprise requirements.

Standard Processes

App wrapping works with Android and iOS applications developed using standard Android and iOS SDK processes.

Standard and C/C++ Libraries

AirWatch App Wrapping works with applications using standard Android and iOS Java/Objective-C layer libraries. If an application uses low-level C/C++ libraries, then some app wrapping features might not work or the application might not wrap properly.

Tampering Protection

Remove tampering protection from the application you want to wrap. AirWatch App Wrapping involves altering the application so app wrapping cannot work with this protection enabled.

Supported Settings and Policies Options

Assign an App Wrapping Profile to apply Workspace ONE SDK funtionality to a wrapped application. Configure the profile in Resources > Profiles & Baselines > SDK Profiles > Add Profile > App Wrapping Profile.

The table lists the default settings supported by AirWatch App Wrapping. For information about supported features for Workspace ONE UEM applications, see the content for that application.

SDK Default Payload App Wrapping for Android App Wrapping for iOS
Force Token For App Authentication Supported
App wrapping supports this setting only when you enable SSO.
Not Supported
Passcode: Authentication Timeout Supported Supported
Passcode: Maximum Number of Failed Attempts Supported Supported
Passcode: Passcode Mode Numeric Supported Supported
Passcode: Passcode Mode Alphanumeric Supported Supported
Passcode: Allow Simple Value Supported Supported
Passcode: Minimum Passcode Length Supported Supported
Passcode: Minimum Number Complex Characters Supported Supported
Passcode: Maximum Passcode Age Supported Supported
Passcode: Passcode History Supported Supported
Passcode: Biometric Mode Supported Supported
Username and Password: Authentication Timeout Supported Supported
Username and Password: Maximum Number of Failed Attempts Supported Supported
Single Sign On Supported Supported
Integrated Authentication: Enable Kerberos Not Supported Not Supported
Integrated Authentication: Use Enrollment Credentials Supported
App wrapping supports this setting only on Android apps that use Webview.
Integrated Authentication: Use Certificate Supported Supported
Offline Access Supported Supported
Compromised Detection Supported Supported
AirWatch App Tunnel: Mode Supported Supported
AirWatch App Tunnel: URLs (Domains) Supported Supported
Geofencing: Area Not Supported Not Supported
DLP: Bluetooth Not Supported Not Supported
DLP: Camera Supported
App wrapping supports this setting on Android only using intents and not by hardware API calls.
DLP: Composing Email Supported Supported
DLP: Copy and Paste Out Supported Supported
DLP: Copy and Paste Into Supported Supported
DLP: Data Backup Not Supported Not Supported
DLP: Location Services Supported Supported
DLP: Printing Supported Supported
DLP: Screenshot Supported Not Supported
DLP: Third Party Keyboards Not Supported Not Supported
DLP: Watermark Not Supported Not Supported
DLP: Limit Documents to Open Only in Approved Applications Supported Supported
NAC: Cellular Connection Not Supported Supported
NAC: Wi-Fi Connection Not Supported Not Supported
Branding Supported
App wrapping only supports branding the loading bar.
Logging Supported
App wrapping supports only SDK logs.
App wrapping supports only SDK logs.
Analytics Not Supported Not Supported
SDK App Compliance > Application Version Not Supported Not Supported
SDK App Compliance > Application Inactivity Not Supported Not Supported
SDK App Compliance > OS Version Not Supported Not Supported
SDK App Compliance > Security Patch Date Not Supported Not Supported

Visual Studio Enterprise Edition

To package applications for installation, use Visual Studio Enterprise Edition. You must select to Enable Bundle Assemblies into Native Code or the app wrapping engine cannot wrap the application.

Android Requirements

Supported Android Components

  • Build the app with the Android API level 21 or later. Older versions of the Android API do not build applications that are compatible with app wrapping.
  • Use the Android GMS library v16.0.0 for Google Play Services because it is the only supported version.
  • Use SQLCipher for Android 4.2 or later.

Android Apps Built with Crosswalk Project Libraries Do Not Wrap

Crosswalk on Android provides a packaging tool and a Java wrapper layer. They can bundle Web applications into the Android Web app APKs. This Java wrapper layer calls Crosswalk runtime, and Crosswalk runtime is a full-featured Web engine mostly written in C/C++. Android platforms do not package C/C++ code into SMALI files, and the app wrapping solution cannot modify and wrap the C/C++ libraries and code.

Android Enterprise Support

  • We support app wrapping in Android Enterprise Work Managed (Device Owner) mode.
  • We do not support app wrapping for Android Enterprise Work Profile (Profile Owner) mode because of internal app constraints. Our app wrapping engine uses internal apps, and we cannot directly publish these apps in Managed Google Play in a Work Profile.

Xamarin Requirements for Android

Workspace ONE UEM is certified to wrap applications built using Xamarin, but you must override all methods by the super class.

To override method() from the super class, call super.method() in the method(). This process requires the addition of code to all applicable classes. You must also use Visual Studio Enterprise Edition to package the application.

Code to Add

Public void onCreate(Bundle param ){
Super.onCreate(param);        // make sure you have this call in order for App Wrapping to be supported with Xamarin apps

Add code to all classes extending to the listed classes.

  • Application.class
  • Activity.class
  • AppCompatActivity.clas,
  • AccountAuthenticatorActivity.class
  • ExpandableListActivity.class
  • FragmentActivity.class
  • ListActivity.class
  • NativeActivity.class
  • LauncherActivity.class
  • PreferenceActivity.class
  • Webview.class
  • WebviewClient.class

Android Bit Architecture Native Files

The VMware Workspace ONE SDK and app wrapping do not support 64-bit architecture native files for Android. These files, when wrapped, do not run and display no screens.

Android Method Limits and Multidex Support

The compiler that app wrapping uses has a limit of 62 thousand methods for applications. With the support of multidex, you can now create larger APKs with each DEX limited to 65 thousand methods. However, app wrapping must inject functionality into the application by adding methods to the primary DEX. To ensure that wrapping completes, ensure that the primary DEX has 58 thousand methods or less. This method count gives the wrapping system room to inject methods into the primary DEX.

Find information on how to limit methods on the Web from the listed site as of November 2018,

Example: Method Limiting in the Gradle File

afterEvaluate {
    tasks.matching {'dex')
    }.each { dx ->
        if (dx.additionalParameters == null) {
            dx.additionalParameters = []
        dx.additionalParameters += "--set-max-idx-number=58000"

Android Apps and the Version of the SDK That Wraps Them

The version of the Workspace ONE SDK the system wraps your app with depends on whether your app uses AndroidX or an older support library. If you want the latest Workspace ONE UEM features, the app must use AndroidX.

  • AndroidX - The app wrapping engine wraps the app with the latest version of the Workspace ONE SDK.
  • Older support library - The app wrapping engine wraps the app with the Workspace ONE SDK for Android v19.7.

Native Libraries in Android Apps

AirWatch App Wrapping cannot fully support native libraries inside Android applications because the wrapping engine cannot interpret the processes these libraries invoke. Applications might wrap but these applications might not behave as expected after you install them on devices. Problems can arise with core functionalities, wrapping restrictions, tunneling, encryption, single sign-on, and other application processes.

Android Library Dependencies

Ensure that the listed libraries are not obfuscated in the original version of the application or wrapping fails.

  • com.sqlcipher:3.5.9
  • com.squareup.okhttp3:okhttp:3.14.2
  • org.apache.commons:codec:1.7
  • org.apache.commons:io:2.4
  • org.apache.commons:codec:1.7
  • org.apache.commons:io:2.4"
  • org.apache.commons:lang3:3.1

Enabling and Deactivating Encryption for Android Wrapped Apps

If you want to use encryption in wrapped Android apps, ensure that no data is read unless you programmatically wrote it to be read. This caveat includes database and file systems.

For those wrapped Android apps that do not use encryption, ensure to deactivate encryption in the Workspace ONE UEM console. If you do not deactivate encryption in the console, the wrapped apps might crash.

iOS Requirements

iOS App Wrapping Requirements

  • App wrapping supports wrapping iOS apps built with Xcode 10 or later.
  • If @executable_path/Frameworks is missing from the Xcode build settings in LD_RUNPATH_SEARCH_PATHS of the build target, add it to Xcode build settings. If you do not add this and you are using the most current wrapping engine, the app crashes after wrapping.
  • If your iOS app is Swift based, use Swift 5.0 or later.
  • iOS Developer Enterprise Account - Use this account to get Xcode used to compile the application as part of the wrapping process. Go to for information. Use this account type to develop iOS applications for use internally and not to deploy to an app store. To develop internal applications, ensure to get auxiliary files for enterprise (internal) distribution and not app store deployment.
  • Mobile Provisioning Profile - Get this file from Apple’s Developer Portal. Get this profile for enterprise use, because it is specific to your application and to the Code Signing Certificate. The bundle ID of the provisioning profile matches the bundle ID of the IPA file.
  • Code Signing Certificate - Get this file from Apple’s Developer Portal. Get this file for enterprise use and not app store distribution, and use it to sign the wrapped application.
  • Sign the iOS Binary - Sign the application with the provisioning profile and the signing certificate before wrapping the application.

Using iOS Apps Developed in Swift

If your iOS app is Swift based, use Swift 5.0 or later.

Entitlements for iOS Apps

Enable the keychain-access-group’s permission in the entitlements of iOS applications before wrapping. This permission allows Workspace ONE UEM to store Secure Channel Certificates in the iOS keychain of the application because Workspace ONE UEM uses Secure Channel Certificates to communicate.

If you do not enable this permission, Workspace ONE UEM automatically enables the permission. If your mobile provisioning profile does not have the keychain-access-group listed in the entitlements, you might have a wrapping issue . The wrapped application might not behave as expected when installed on devices.

Mobile Provisioning Profile for iOS Apps

Ensure you use a mobile provisioning profile that matches the bundle ID of the application. Wildcard provisioning profiles might not allow the use of certain entitlements, like iCloud.

Synchronous Calls and iOS Apps

Avoid synchronous calls, if possible. Instead, consider using asynchronous methods or putting synchronous calls in their own threads. Synchronous logic can negatively impact the ability of the feature to intercept preventable calls.

Integrated Authentication Code Requirements for iOS (Swift) Apps

For integrated authentication to work for apps that use the URLSession class, use the sharedSession API to create the session.

No Support for UIWindowSceneDelegate in iOS Apps

App wrapping does not support wrapping iOS apps that use Windows Scenes (UIWindowSceneDelegate).

check-circle-line exclamation-circle-line close-line
Scroll to top icon