Install the Workspace ONE Intelligent Hub on your Linux devices to establish communication between devices and the Workspace ONE UEM console. Linux enrollment is a two-step process; first you install the Intelligent Hub, and secondly you enroll devices with the ws1HubUtil command. If desired, you can fully script the enrollment in a single command, or you can prompt the user to enter enrollment information.

Devices can be enrolled at the same time you install the Intelligent Hub, or devices can be enrolled with ws1HubUtil after after installation of the Intelligent Hub. In either case, you can fully script the enrollment in a single command, or you can prompt the user to enter enrollment information.


You must enroll Linux devices to establish communication between the devices and Workspace ONE UEM for devices to access internal content and features.

Currently, SAML authentication or directory lookup for enrollment is not supported. Also, advanced and single-user staging enrollments are not supported, where an admin enrolls on behalf of a user, or enrolls and waits for a user to enter credentials. The enrollment user must exist in the WS1 UEM console (basic or pre-synced Directory user acccounts).

A working knowledge of the linux command line is required. Unlike other platforms, the WS1 Intelligent Hub for Linux does not have a graphical user interface and requires the command line to install, enroll, and interact with it on the device itself.

Before enrolling a Linux endpoint, gather the UEM Device Services URL, organization Group ID, and the enrollment user's username and password. You can also enroll with a token using the '--token' argument and use it in the `--group` argument. You are prompted for username and password, but you can leave these blank when enrolling with a token. Consult the section of this guide titled "Supported Command-line Arguments for the ws1HubUtil Enroll Command" for more details of the enrollment arguments and options available, or run the command ./ws1HubUtil enroll -h

Installers are created for specific distributions and architectures. Ensure you are using the correct installer for your device and distribution.

The device must be running SystemD or System V init in order for Hub to run as a system service. Puppet agent is required for custom configurations. If running a Debian-based (deb) or Red Hat-based (rpm) system, this is installed automatically with Hub. For other systems, it must be installed manually prior to WS1 enrollment.


  1. Download the Workspace ONE Intelligent Hub for Linux to your intended device. The downloaded file must correspond to the targeted processor architecture and distribution. The agent is available as deb, rpm, or tgz packages and can be downloaded either directly to your Linux device or can be transferred to the Linux device via USB or SSH.

    The installers can be retrieved from the following locations:

  2. Run the Workspace ONE Intelligent Hub client installer with root privileges.

    For example:

    For Debian package on Ubuntu:  
    $ sudo apt install "/tmp/workspaceone-intelligent-hub-amd64-" 
    For RPM package on Fedora:  
    $ sudo dnf install workspaceone-intelligent-hub-amd64- 
    For RPM package on OpenSUSE:  
    $ sudo zypper install workspaceone-intelligent-hub-amd64- 
    For Tarball (any other linux distribution):  
    1. Extract the Package using: $ tar xvf workspaceone-intelligent-hub-<arch>. 
    2. Install the Package using: $ sudo ./

    When utilizing the Tarball, Ruby must be manually installed prior to installing the Intelligent Hub.

  3. Enrollment

    Enroll your device in Workspace ONE UEM after the installation by using the ws1HubUtil. Choose to send enrollment details in one command or separately. Follow the steps below to send them in one command.

  4. 1. Change directory to the Hub binary directory under the installation directory.

    $ cd /opt/vmware/ws1-hub/bin

  5. Run the **ws1HubUtil** and include the enrollment arguments in order.

    $ sudo ./ws1HubUtil enroll --server --user <username> --password <password> --group <organization group id>

    To prompt the users for enrollment credentials when they enroll, run the ws1HubUtil without these additional arguments. Please see Supported Command Line Arguments for more details before attempting an enrollment.

  6. After successful installation and registration, the linux device will be listed in the WS1 UEM Console.
  7. Uninstall

    To uninstall the Intelligent Hub for Linux you can either send an Enterprise Wipe command from the WS1 UEM Console (for an enrolled device) or you can manually uninstall device side. If the uninstall command is used device side on an enrolled device, the device will be unenrolled first.

    For Debian: $ sudo apt remove workspaceone-intelligent-hub

    For RPM for Fedora: $ sudo zypper remove workspaceone-intelligent-hub

    For Tarball: $ sudo /opt/Workspace-ONE-Intelligent-Hub/