The Settings and Policies area in VMware Workspace ONE® UEM has settings that control security, application behaviors, and the retrieval of specified data in apps that use the Workspace ONE SDK framework. To deploy Workspace ONE UEM features to apps, assign the default SDK profile or a custom SDK profile set with your Workspace ONE SDK settings.

Apply these SDK features and settings to the listed applications.
  • Applications built with the Workspace ONE SDK
  • Workspace ONE productivity apps
  • Applications wrapped by the AirWatch App Wrapping engine

Types of SDK Profiles

Workspace ONE UEM has two types of SDK profiles - default and custom. To select the type of SDK profile, determine the scope of deployment.
Note: This guide outlines how to work with the default SDK profiles. However, most of the settings in the deafult SDK profiles are mirrored in the custom SDK profiles.
  • Default profiles work well across organization groups, applying to large numbers of devices.

    Find the settings for the default SDK profile in Groups & Settings > All Settings > Apps > Settings and Policies and then select Security Policies, Settings, or SDK App Compliance. You can apply these default profile options across all the Workspace ONE UEM applications in an organization group. Options shared across all organization groups are easier to manage and configure because you can manage them from a single profile.

    Find the default SDK settings in the UEM console to apply SDK settings across all your SDK-built apps and your Workspace ONE Productivity apps.

  • Custom profiles work for individual devices or for small numbers of devices with applications that require special mobile application management (MAM) features. Custom profiles offer granular control for specific applications and the ability to override default settings. However, they also require separate input and maintenance.
    You can configure various types of custom profiles.
    • SDK Profile - This profile offers most options found in the default SDK profiles. They work for applications that have the Workspace ONE SDK embedded in them.
    • Application Profile - This legacy profile was used to configure certificate authorities or other credential sources for SDK-built apps. However, consider using the Credentials option in an SDK Profile to apply certificate configurations to your SDK-built apps.
    • Components Profile - This profile offers configurations to apply to apps that use the Workspace ONE Modular SDK. This SDK has a lighter footprint thank the Workspace ONE SDK.
      Note: For information on Components Profiles and their uses, see Shift-Based Access Control.
    • App Wrapping Profile - This profile configures your apps wrapped with the AirWatch App Wrapping service.
    Find the settings for custom SDK profiles in Resources > Profiles & Baselines > SDK Profiles.
    Note: You cannot assign custom SDK profiles to the Workspace ONE Intelligent Hub. You must assign it the default SDK profile.

    Custom SDK profiles contain most of the same settings as the default SDK profiles but allow you to apply settings to a single SDK-built app or a single Productivity app.

Requirements to Use SDK Features

You must complete several tasks to successfully use SDK features with your SDK and productivity apps.
  1. You must configure either the default SDK profile or create a custom SDK profile.
  2. You must assign the profile to your SDK or productivity app.
    Assign the profile when you upload or edit the application to the Workspace ONE UEM console in the Apps section. When you change the default or custom profile, Workspace ONE UEM applies these edits when you select Save. Changes to end-use devices can take a few minutes to deploy. Users can close and restart Workspace ONE UEM applications to receive updated settings.
    Note: There is no process to use push notifications to trigger devices to retrieve SDK policy updates. The console includes a scheduler task to fetch and send SDK settings and policies to devices. To get policy updates immediately, users can stop and start their SDK-built apps.
    1. Navigate to Resources > Apps > Native > <App Type>.
    2. Add or edit an application.
    3. Select a profile on the SDK tab. You can use the default SDK profile or you can use a custom profile.
      • To use the default SDK profile, select the Android Default Settings @ Global or the iOS Default Settings @ Global from the SDK Profile list.
      • To use a custom SDK profile, select it from the SDK Profile list.
    4. Make other configurations and then save the application and create assignments for its deployment.
  3. You must assign the default SDK profile to the Workspace ONE Intelligent Hub. You configure the default SDK profile in the console at Groups & Settings > All Settings > Apps > Settings and Policies and then select Security Policies, Settings, or SDK App Compliance. If you do not assign the default SDK profile to the Workspace ONE Intelligent Hub to apply SDK configurations, your SDK configurations in Settings and Policies do not work in applications.
    Note: You cannot use custom SDK profiles with the Workspace ONE Intelligent Hub. The Workspace ONE Intelligent Hub only supports the default profile set in either the Security Policies, Settings, or SDK App Compliance sections of Settings and Policies.
    Note: The system assigns the default SDK profile for iOS to the Workspace ONE Intelligent Hub for iOS by default. You do not need to manually apply this mechanism. The steps to assign the default SDK remain in the documentation so you know where the settings reside. This mechanism is not in place for the Android platform.
    • Workspace ONE Intelligent Hub for iOS
      1. Navigate to Groups & Settings > All Settings > Devices & Users > Apple > Apple iOS > Intelligent Hub Settings.
      2. Set the SDK Profile option to the default profile by selecting iOS Default Settings @ Global.
    • Workspace ONE Intelligent Hub for Android
      1. Navigate to Groups & Settings > All Settings > Devices & Users > Android > Intelligent Hub Settings.
      2. Set the SDK Profile option to the default profile by selecting Android Default Settings @ Global.

What Happens if You Do Not Assign Your SDK or Productivity Apps an SDK Profile?

Workspace ONE UEM assigns profiles at the closest organization group (OG). You can control which profile your apps get (and what SDK functionality the apps use) when you upload and deploy them in the Apps section of the console. Assigning the SDK profile to the app in the Apps section is best.

If you do not assign an SDK profile (default or custom) to your SDK and productivity apps in the Apps section of the console, then Workspace ONE UEM assigns the default SDK profile configured at the OG closest to the device.

Another scenario that influences the SDK features your SDK and productivity apps use occurs if you have the same app at the parent and its child OG. If you do not assign an SDK profile to an app in a child OG that is also in the parent OG, there are various outcomes.
Table 1. Apps Deployed Both at Child and Parent OGs, What SDK Profile Does Your App in the Child OG Receive?
Is the SDK profile (custom or default) set in the Apps section for the Child version of the app? Does the parent version have the SDK profile set in Apps? Result
No Yes Devices that enroll in the child OG receive the app with the parent OG version of the SDK profile set in the Apps section.
No No Devices that enroll in the child OG receive the app with the default SDK profile set at the child OG.