After you install and configure the servers, you must install the platform-specific agents on the devices so that they can be remotely managed with Workspace ONE Assist. You may also have to enable the device to accept remote control.

Install the Assist App for Windows and macOS

  1. Visit the https://my.workspaceone.com/products page that lists all the available device agents.
  2. Identify and download platform-specific Workspace ONE Assist agents that are applicable to your deployment.
    Note:

    With regard to the permission prompts for the Remote View and Remote Control functions on macOS devices, be aware of the following.

    • macOS devices running version 10.14 (Mojave) allow the Share Screen feature by default. No additional permissions are required to share the screen, therefore, no prompt is displayed at the beginning of a Share Screen session.
    • For macOS devices running version 10.15 (Catalina), the Share Screen and Remote View features both require that you enable the Screen Recording permission to Workspace ONE Assist in the Privacy tab of Security & Privacy preferences, located in System Preferences. Only during the first time you initiate a Share Screen session with a qualifying macOS device, an access request popup displays including a convenience link to this privacy setting in System Preferences.
    • Similarly, macOS devices running version 11 (Big Sur) or later must enable Screen Recording permission to Workspace ONE Assist for both Remote View and Share Screen features. This permission is configured in a slightly different way for version 11:

      Enable Screen Recording by navigating to System Preferences > Security & Privacy > Privacy tab > Screen Recording then select the Lock icon to unlock the Privacy settings and enter the Administrator password. This is a one-time activation by the end user.

Install the Assist App for iOS

iOS devices do not require a separate Assist application. The Assist libraries are built into the Intelligent Hub. To prepare your iOS devices to use the Remote View feature, see How Do You Enable Remote View for iOS Devices.

On Workspace ONE UEM version 2101 or later, a privacy flag is introduced to activate or deactivate Remote View on iOS devices at an Organization Group (OG) level.

To configure this flag:
  1. Navigate to Groups & Settings > All Settings > Devices & Users > General > Privacy.
  2. On the Privacy screen, turn on or off the Remote Control flag for each ownership type.
On existing Customer Organization Groups, this flag value remains the same as the previous value set prior to the 2101 upgrade. On new Customer Organization Groups, this flag is deactivated by default. To enable Remote view, simply turn the flag on for the necessary ownership types.

Install the Assist App for Android

  1. Visit the https://my.workspaceone.com/products page that lists all the available device agents.
  2. Download and install the platform-specific Workspace ONE Assist agent.
  3. To provide full remote control support on Android devices, VMware has partnered with many of the top Android device manufacturers to make OEM-specific service applications. Download and install the OEM specific service application on the device.
  4. If the launcher mode is enabled on Samsung devices, you must allowlist the following activities in order for you to be able to respond to the prompts during the installation of the Assist agent. For devices with launcher version 4.9, the launcher automatically displays the prompts.

    com.samsung.klmsagent.activities.ConfirmDialog

    com.android.packageinstaller.permission.ui.GrantPermissionsActivity

    Note:
    • Android devices by Samsung and Sony do not require this OEM-specific service application, as they include support for Assist out of the box. Zebra devices with Android 11 or later also support Workspace ONE Assist out of the box. This support means customers do not need to deploy the Zebra-specific service application APK file on their Zebra devices running Android 11 or later.
    • With Assist 21.09, Android devices running Android 7.1 and later no longer require a OEM-specific service application to be installed to support full remote control. For full remote control, end users must provide additional permissions such as:
      • Enable screen share for every session on Android 10 and later.
      • Enable accessibility service for each remote control session.

      Accessibility service cannot be enabled within a Work Profile, hence, remote control using Accessibility service cannot be leveraged on COPE and BYOD devices.

    • To leverage KNOX Remote Control APIs on Samsung devices, the end user must accept a KNOX End User License Agreement on the remote device. This permission is required on Unattended mode of connection as well. From Assist 22.04, this permission is requested on the Unattended mode agent at the time of application installation. On Assist Attended mode, this permission is requested during the first remote control session.
    • For Android Enterprise Enrolled BYOD Devices, see How Do You Enable Remote Control for Android Enterprise Enrolled BYOD Devices.
    • For Android Enterprise Enrolled COPE Devices, see How Do You Enable Remote Control for Android Enterprise Enrolled COPE Devices.

Install Assist app for Linux

To remotely manage a Linux or Linux based IoT device, you must install the Workspace ONE Assist application on a Linux device already enrolled in UEM. Once the Assist application is installed on the Linux device, you must register it to the Workspace ONE Assist server. You can verify the status of the registration by navigating to the Device detailed view > More > Troubleshooting > Event Logs.

Workspace ONE Assist is compatible with all distributions of Linux running on either x64, ARM5, or ARM7 architectures.

You can install the Assist application on the Linux device either:
  • Manually on the device

    OR

  • Using a Workspace ONE custom configuration profile
Install Assist Manually
If you have physical access to the Linux device, install the Assist agent manually using this method.
  1. On the Linux device, open a browser and navigate to the VMware Workspace ONE Resource Portal.
  2. Download the Workspace ONE Assist agent directly on the Linux device. You can also use an alternative method for copying the agent to the Linux device.
  3. Extract the package.
  4. Change the directory using the command.
    $ cd ws1-assist_21.09.00.69_release_linux-<arch>
  5. Install the package using the command.
    $ sudo ./install.sh
Install using Custom Configuration Profile
Install the Workspace ONE Assist agent on the remote Linux device using a Workspace ONE custom configuration profile which uses puppet manifests.
  1. Navigate to Resources > Profiles & Baselines > Profiles on the Workspace ONE UEM console. Depending on your UEM version, the Profiles tab is available either under Devices or Resources.
  2. Create a Linux profile or update an existing one to add a new custom configuration for Workspace ONE Assist.
  3. On the Custom Configuration page, enter a name and create a puppet manifest to install the Assist application on your Linux devices. You can access the sample manifest file at https://resources.workspaceone.com/view/v9dm3bwbr9lvjhvdxlsm/en and modify it as per your need.
  4. Once the custom configuration is added, select Save and Publish to publish the Linux profile to your Linux devices.

How Do You Enable Remote Control with Samsung Knox Service Plugin

You can enable Samsung Knox devices to be remotely controlled with Workspace ONE Assist by installing the Knox Service Plugin.

The Samsung Knox Service Plugin is only available on Android 9.0 (Pie) and later. The only deployment modes supported are Profile Owner (PO) and Device Owner (DO). For detailed compatibility information, see Which Profile/Ownerships Work with Samsung Knox.

With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices running Android 10.0 and later.
  1. Log in to the Workspace ONE UEM Console.
  2. Navigate to Apps and Books > Applications > Native, select the Public tab, and then select Add Application.
  3. Select Android as the platform and enter "Knox Service Plugin" for the Name option.
  4. Select the Knox Service Plugin from the list of applications.Knox Service Plugin seen in the displayed list of applications.
  5. Click the Select button.

    Select button displayed for the Knox Service Plugin app.

  6. Add additional details as needed. Select Save and Assign to continue.
  7. Select Add Assignment.

    The Assignments page of the UEM console for adding assignments is shown.

  8. Select your applicable assignment groups.
  9. Select the desired application delivery method: Auto to automatically apply the application assignment and On Demand to allow the device user to opt-out of the app assignment.

    Auto and On Demand delivery methods are shown on the Add Assignment page of the UEM console.

  10. Select CONFIGURE next to Application Configuration.
  11. Enter the KNOX Premium License Key.

    The fields for application configuration details such as Profile name, Knox Premium License key are shown.

    The Knox premium license key is mandatory to enable remote control within the work profile on Android 9.x.

  12. Select CONFIGURE next to Work profile policies (Profile Owner).
  13. Select the Enable drop-down next to Enable Work Profile Policies. Then enable the two options under Advanced restrictions in work profile and Allow remote control. Then select the ADD button.

    Work profile polices and the advanced work profile restrictions are shown.

  14. Select Add again to save the assignment.
  15. Finally, select Save and Publish to publish the Knox Service Plugin with the configured policies.

    Once the Knox Service Plugin is installed on the device and the policies are applied successfully, remote control is available within the work profile.

    Samsung Knox devices can now be remotely controlled using Workspace ONE Assist.

    Note: On Samsung BYOD devices, only applications in the Work Profile can be viewed and controlled. If you navigate to the Work profile home screen or personal side of a Samsung BYOD device during a Workspace ONE Assist session, it only displays a blank screen.

How Do You Enable Remote View For iOS Devices

The steps for enabling the Remote View feature for your iOS devices vary based on the Intelligent Hub version installed on the devices. Follow the steps for the appropriate Intelligent Hub version on your device.

For devices with Intelligent Hub 20.11 or later

  1. Ensure Workspace ONE Intelligent Hub 20.11 or later is installed.
    Note: The iOS version used must be 13 or later.
  2. Request the iOS device user to open the Hub notification received or launch the Workspace ONE Intelligent Hub.
  3. Select Start Sharing and then select Start Broadcast.

    The iOS device screen showing the notification to start sharing the screen. The iOS device screen showing the Start Broadcast option.

    The end user can pause or disconnect the connection anytime during the remote view session.

    The iOS device screen shows the options to either pause or stop the screen share. When the user chooses to stop screen share, the iOS device screen shows the prompt to stop or continue the screen share.
  4. If the session is interrupted, the end user must start the screen broadcast from the Control Center using the following procedure:
    1. Open Control Center using the screen gesture appropriate for your iOS model.
    2. Press and hold down the Screen Recording icon (The grey Screen Recording icon is used to start screen sharing.).
    3. Enable Hub Broadcast.
    4. Select Start Broadcast.

      The iOS device screen shows the Start Broadcast option.

For devices with Intelligent Hub 20.11 or earlier
  1. Ensure Workspace ONE Intelligent Hub 20.11 or earlier is installed.
  2. Request the iOS device end user to perform the following one time setup.
    1. Navigate to Settings > Control Center > Customize Controls and add Screen Recording to the Control Center by selecting its green plus sign.

      The iOS device screen shows the Screen Recording setting.

  3. Request the iOS device end user to perform the following procedure before each Remote View session.
    1. Open Control Center using the screen gesture appropriate for your iOS model.
    2. Press and hold down the Screen Recording icon (The grey Screen Recording icon is used to start screen sharing.).
    3. Enable Hub Broadcast.
    4. Select Start Broadcast.

      The iOS device screen shows the Start Broadcast option.

      This iOS device can now be remotely viewed using Workspace ONE Assist.

How Do You Enable Remote Control for Android Enterprise Enrolled BYOD Devices

You must enable your Android Enterprise enrolled BYOD devices to work with Workspace ONE Assist before they can be remotely controlled.

The Assist Agent and OEM-specific Assist Service package can be auto installed from Workspace ONE UEM or made available for the end user to install when needed.

The Workspace ONE Assist Agent is available at https://my.workspaceone.com/products.

  • On BYOD Enrolled devices, the Assist agent always behaves as an Attended agent. Even if the Unattended agent is pushed to the device, the Assist agent continues to behave as an Attended agent due to the presence of the Work Profile.

CHOOSE ONE PATH ONLY

YOU MUST SELECT BETWEEN TWO CHOICES.

YOU CAN EITHER PUSH CONTENT USING UEM OR LEAVE IT TO THE END USER. Do not perform both.

PUSH CONTENT USING UEM LEAVE IT TO THE END USER
  1. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the Workspace ONE Assist agent as a managed PlayStore application. For more information, see Mobile Application Management.
  2. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the OEM-specific Assist Service as a managed PlayStore application. This step is required to enable remote control on all supported OEMs except Samsung and Sony. For more information, see Product Provisioning.
  3. Create a smart group that includes these Android Enterprise enrolled BYOD devices.
  4. Assign the agent and OEM-specific Assist Service to the smart group you created and automatically push the application to all managed devices in the smart group. For more information, see Smart Groups.
  5. Proceed directly to the What to do next section.
  1. Make the Workspace ONE Assist agent and OEM-specific service application available as Public applications through the Play Store.
  2. Direct your Android BYOD end users to navigate to the Work Profile.
  3. The end user must open the Play Store from within the Work Profile.
  4. End user must download and install the Workspace ONE Assist Agent.
  5. If applicable, the end user must download and install the OEM-specific service application. This step is required to enable remote control on all supported OEMs except Samsung and Sony.
  6. Proceed directly to the What to do next section.
Note: On Samsung BYOD devices, only applications in the Work Profile can be viewed and controlled. If you navigate to the Work profile home screen or personal side of a Samsung BYOD device during a Workspace ONE Assist session, it only displays a blank screen.
Note: On Samsung BYOD devices, remote control is deactivated by default within All Work Profiles under Android 9.0 (with Knox versions earlier than 3.4.1) and Premium Work Profiles under Android 10.0 or later (with Knox 3.4.1 or later). You can enable remote control on these work profiles by installing the KNOX Service Plug-in together with the appropriate OEM Config policy. For more information, see How Do You Enable Remote Control with Samsung Knox Service Plugin and Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android.

With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices under Android 10.0 and later.

A Knox Premium License is necessary to enable remote control on Work Profiles with Knox versions earlier than 3.4.1.

How Do You Enable Remote Control for Android Enterprise Enrolled COPE Devices

You must enable your Android Enterprise enrolled COPE (Corporate-Owned, Personally-Enabled) devices to work with Workspace ONE Assist before they can be remotely controlled.

The Workspace ONE Assist Agent is available at https://my.workspaceone.com/products.

  1. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the Workspace ONE Assist agent.
    • Android 8, 9, and 10 devices must add the Workspace ONE Assist agent as a managed internal application.
    • Android 11 devices must add the Workspace ONE Assist agent as a managed PlayStore application.

      For more information, see Mobile Application Management documentation.

  2. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the OEM-specific Assist Service. This step is required to enable remote control on all supported OEMs except Samsung and Sony.
    • Android 8, 9, and 10 devices must add the OEM-specific Assist Service as a managed internal application.
    • Android 11 devices must add the OEM-specific Assist Service as a managed PlayStore application.

      For more information, see Product Provisioning.

  3. Create a smart group that includes these Android Enterprise enrolled COPE devices.
  4. Assign the agent and OEM-specific Assist Service to the smart group you created and push it to managed devices. For more information, see Smart Groups.
  5. Direct the device End User to uninstall the Workspace ONE Assist application if it was previously installed on the personal side of the device in Android 8, 9, or 10.
    • For Android 8, 9, and 10 devices, the end user must uninstall Workspace ONE Assist from the personal side of the device.
    • For Android 11 devices, the end user must uninstall Workspace ONE Assist from the work profile on the device.

      On Samsung COPE devices, the Personal profile and Work profile can be remote controlled.

Few important information to note:

  • On COPE Enrolled devices, the Assist agent always behaves as an Attended agent. Even if the Unattended agent is pushed to the device, the Assist agent continues to behave as an Attended agent due to the presence of the Work Profile.
  • Devices running under Android 8 (Oreo), 9 (Pie), and 10, the Workspace ONE Assist application operates on the personal side of the device to provide remote control functionality to the entire device. As a result, the Workspace ONE Assist app must be installed as an internal application.
  • On devices running Android 11, the Workspace ONE Assist app can no longer run on the personal side of a COPE device. The Assist application can operate only within the Work profile on COPE devices. As a result, once a device is upgraded to Android 11, the Assist application must be uninstalled from the personal side and reinstalled on the Work profile as a managed Play Store application.
  • On Samsung COPE devices, prior to Assist 22.04, due to Knox restrictions, Remote View and Control was only supported within the work profile applications. Because the home screen and the application launcher screen within the work profile tab are both considered personal, Assist could only provide Remote View and Control capabilities when the end user manually launched the application to foreground. On the work profile on Samsung devices, starting with Assist 22.04, the entire device, including the home screen, settings, and all other screens, can be remotely viewed.
  • On Samsung COPE devices, remote control is deactivated by default within All Work Profiles under Android 9.0 (with Knox versions earlier than 3.4.1) and Premium Work Profiles under Android 10.0 or later (with Knox 3.4.1 or later). You can enable remote control on these work profiles by installing the KNOX Service Plug-in together with the appropriate OEM Config policy. For more information, see How Do You Enable Remote Control with Samsung Knox Service Plugin and Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android.

    With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices under Android 10.0 and later.

    A Knox Premium License is necessary to enable remote control on Work Profiles with Knox versions earlier than 3.4.1.