Now that the servers have been installed and configured you must install the platform-specific agents on the devices so that they can be remotely managed with Workspace ONE Assist. You may also have to enable the device to accept remote control.

Install the Assist App for Windows and macOS

  1. Visit the https://my.workspaceone.com/products page that lists all the available device agents.
  2. Identify and download platform-specific Workspace ONE Assist agents that are applicable to your deployment.
    Note:

    With regard to the permission prompts for the Remote View and Remote Control functions on macOS devices, be aware of the following.

    • macOS devices running version 10.13 (High Sierra) and 10.14 (Mojave) allow the Share Screen feature by default. No additional permissions are required to share the screen, therefore, no prompt is displayed at the beginning of a Share Screen session.
    • For macOS devices running version 10.15 (Catalina), the Share Screen and Remote View features both require that you enable the Screen Recording permission to Workspace ONE Assist in the Privacy tab of Security & Privacy preferences, located in System Preferences. Only during the first time you initiate a Share Screen session with a qualifying macOS device, an access request popup displays including a convenience link to this privacy setting in System Preferences.
    • Similarly, macOS devices running version 11 (Big Sur) or later must enable Screen Recording permission to Workspace ONE Assist for both Remote View and Share Screen features. This permission is configured in a slightly different way for version 11:

      Enable Screen Recording by navigating to System Preferences > Security & Privacy > Privacy tab > Screen Recording then select the Lock icon to unlock the Privacy settings and enter the Administrator password. This is a one-time activation by the end user.

Install the Assist App for iOS

iOS devices do not require a separate Assist application. The Assist libraries are built into the Intelligent Hub. To prepare your iOS devices to use the Remote View feature, see How Do You Enable Remote View for iOS Devices.

On Workspace ONE UEM version 2101 or later, a privacy flag is introduced to enable or disable Remote View on iOS devices at an Organization Group (OG) level.

To configure this flag:
  1. Navigate to Groups & Settings > All Settings > Devices & Users > General > Privacy.
  2. On the Privacy screen, turn on or off the Remote Control flag for each ownership type.
On existing Customer Organization Groups, this flag value remains the same as the previous value set prior to the 2101 upgrade. On new Customer Organization Groups, this flag is disabled by default. To enable Remote view, simply turn the flag on for the necessary ownership types.

Install the Assist App for Android

  1. Visit the https://my.workspaceone.com/products page that lists all the available device agents.
  2. Download and install the platform-specific Workspace ONE Assist agent.
  3. To provide full remote control support on Android devices, VMware has partnered with many of the top Android device manufacturers to make OEM-specific service applications. Download and install the OEM specific service application on the device.
  4. If the launcher mode is enabled on Samsung devices, you must whitelist the following activities in order for you to be able to respond to the prompts during the installation of the Assist agent.

    com.samsung.klmsagent.activities.ConfirmDialog

    com.android.packageinstaller.permission.ui.GrantPermissionsActivity

    Note:

How Do You Enable Remote Control with Samsung Knox Service Plugin

You can enable Samsung Knox devices to be remotely controlled with Workspace ONE Assist by installing the Knox Service Plugin.

The Samsung Knox Service Plugin is only available on Android 9.0 (Pie) and later. The only deployment modes supported are Profile Owner (PO) and Device Owner (DO). For detailed compatibility information, see Which Profile/Ownerships Work with Samsung Knox.

With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices running Android 10.0 and later.
  1. Log in to the Workspace ONE UEM Console.
  2. Navigate to Apps and Books > Applications > Native, select the Public tab, and then select Add Application.
  3. Select Android as the platform and enter "Knox Service Plugin" for the Name option.
  4. Select the Knox Service Plugin from the list of applications.
  5. Click the Select button.

  6. Add additional details as needed. Select Save and Assign to continue.
  7. Select Add Assignment.

  8. Select your applicable assignment Groups.
  9. Select the desired application delivery method: Auto to automatically apply the application assignment and On Demand to allow the device user to opt-out of the app assignment.

  10. Select CONFIGURE next to Application Configuration.
  11. Enter the KNOX Premium License Key.

    The Knox premium license key is mandatory to enable remote control within the work profile on Android 9.x.

  12. Select CONFIGURE next to Work profile policies (Profile Owner).
  13. Select the Enable drop-down next to Enable Work Profile Policies. Then enable the two options under Advanced restrictions in work profile and Allow remote control. Then select the ADD button.

  14. Select Add again to save the assignment.
  15. Finally, select Save and Publish to publish the Knox Service Plugin with the configured policies.

    Once the Knox Service Plugin is installed on the device and the policies are applied successfully, remote control is available within the work profile.

    Samsung Knox devices can now be remotely controlled using Workspace ONE Assist.

    Note: On Samsung BYOD devices, only applications in the Work Profile can be viewed and controlled. If you navigate to the Work profile home screen or personal side of a Samsung BYOD device during a Workspace ONE Assist session, it only displays a blank screen.

How Do You Enable Remote View For iOS Devices

The steps for enabling the Remote View feature for your iOS devices vary based on the Intelligent Hub version installed on the devices. Follow the steps for the appropriate Intelligent Hub version on your device.

For devices with Intelligent Hub 20.11 or later

  1. Ensure Workspace ONE Intelligent Hub 20.11 or later is installed.
    Note: The iOS version used must be 13 or later.
  2. Request the iOS device user to open the Hub notification received or launch the Workspace ONE Intelligent Hub.
  3. Select Start Sharing and then select Start Broadcast.

    The end user can pause or disconnect the connection anytime during the remote view session.

  4. If the session is interrupted, the end user must start the screen broadcast from the Control Center using the following procedure:
    1. Open Control Center using the screen gesture appropriate for your iOS model.
    2. Press and hold down the Screen Recording icon ().
    3. Enable Hub Broadcast.
    4. Select Start Broadcast.

For devices with Intelligent Hub 20.11 or earlier
  1. Ensure Workspace ONE Intelligent Hub 20.11 or earlier is installed.
  2. Request the iOS device end user to perform the following one time setup.
    1. Navigate to Settings > Control Center > Customize Controls and add Screen Recording to the Control Center by selecting its green plus sign.

  3. Request the iOS device end user to perform the following procedure before each Remote View session.
    1. Open Control Center using the screen gesture appropriate for your iOS model.
    2. Press and hold down the Screen Recording icon ().
    3. Enable Hub Broadcast.
    4. Select Start Broadcast.

      This iOS device can now be remotely viewed using Workspace ONE Assist.

How Do You Enable Remote Control for Android Enterprise Enrolled BYOD Devices

You must enable your Android Enterprise enrolled BYOD devices to work with Workspace ONE Assist before they can be remotely controlled.

The Assist Agent and OEM-specific Assist Service package can be auto installed from Workspace ONE UEM or made available for the end user to install when needed.

The Workspace ONE Assist Agent is available at https://my.workspaceone.com/products.

  • On BYOD Enrolled devices, the Assist agent always behaves as an Attended agent. Even if the Unattended agent is pushed to the device, the Assist agent continues to behave as an Attended agent due to the presence of the Work Profile.

CHOOSE ONE PATH ONLY

YOU MUST SELECT BETWEEN TWO CHOICES.

YOU CAN EITHER PUSH CONTENT USING UEM OR LEAVE IT TO THE END USER. Do not perform both.

PUSH CONTENT USING UEM LEAVE IT TO THE END USER
  1. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the Workspace ONE Assist agent as a managed PlayStore application. For more information, see Mobile Application Management.
  2. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the OEM-specific Assist Service as a managed PlayStore application. This step is required to enable remote control on all supported OEMs except Samsung and Sony. For more information, see Product Provisioning.
  3. Create a smart group that includes these Android Enterprise enrolled BYOD devices.
  4. Assign the agent and OEM-specific Assist Service to the smart group you created and automatically push the application to all managed devices in the smart group. For more information, see Smart Groups.
  5. Proceed directly to the What to do next section.
  1. Make the Workspace ONE Assist agent and OEM-specific service application available as Public applications through the Play Store.
  2. Direct your Android BYOD end users to navigate to the Work Profile.
  3. The end user must open the Play Store from within the Work Profile.
  4. End user must download and install the Workspace ONE Assist Agent.
  5. If applicable, the end user must download and install the OEM-specific service application. This step is required to enable remote control on all supported OEMs except Samsung and Sony.
  6. Proceed directly to the What to do next section.
Note: On Samsung BYOD devices, only applications in the Work Profile can be viewed and controlled. If you navigate to the Work profile home screen or personal side of a Samsung BYOD device during a Workspace ONE Assist session, it only displays a blank screen.
Note: On Samsung BYOD devices, remote control is disabled by default within All Work Profiles under Android 9.0 (with Knox versions earlier than 3.4.1) and Premium Work Profiles under Android 10.0 or later (with Knox 3.4.1 or later). You can enable remote control on these work profiles by installing the KNOX Service Plug-in together with the appropriate OEM Config policy. For more information, see How Do You Enable Remote Control with Samsung Knox Service Plugin and Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android.

With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices under Android 10.0 and later.

A Knox Premium License is necessary to enable remote control on Work Profiles with Knox versions earlier than 3.4.1.

How Do You Enable Remote Control for Android Enterprise Enrolled COPE Devices

You must enable your Android Enterprise enrolled COPE (Corporate-Owned, Personally-Enabled) devices to work with Workspace ONE Assist before they can be remotely controlled.

  • On COPE Enrolled devices, the Assist agent always behaves as an Attended agent. Even if the Unattended agent is pushed to the device, the Assist agent continues to behave as an Attended agent due to the presence of the Work Profile.
  • Devices running under Android 8 (Oreo), 9 (Pie), and 10, the Workspace ONE Assist application operates on the personal side of the device to provide remote control functionality to the entire device. As a result, the Workspace ONE Assist app must be installed as an internal application.
  • On devices running Android 11, the Workspace ONE Assist app can no longer run on the personal side of a COPE device. The Assist application can operate only within the Work profile on COPE devices. As a result, once a device is upgraded to Android 11, the Assist application must be uninstalled from the personal side and reinstalled on the Work profile as a managed Play Store application.

The Workspace ONE Assist Agent is available at https://my.workspaceone.com/products.

  1. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the Workspace ONE Assist agent.
    • Android 8, 9, and 10 devices must add the Workspace ONE Assist agent as a managed internal application.
    • Android 11 devices must add the Workspace ONE Assist agent as a managed PlayStore application.

      For more information, see Mobile Application Management documentation.

  2. From the Workspace ONE UEM console, use Apps and Books or Product Provisioning to add the OEM-specific Assist Service. This step is required to enable remote control on all supported OEMs except Samsung and Sony.
    • Android 8, 9, and 10 devices must add the OEM-specific Assist Service as a managed internal application.
    • Android 11 devices must add the OEM-specific Assist Service as a managed PlayStore application.

      For more information, see Product Provisioning.

  3. Create a smart group that includes these Android Enterprise enrolled COPE devices.
  4. Assign the agent and OEM-specific Assist Service to the smart group you created and push it to managed devices. For more information, see Smart Groups.
  5. Direct the device End User to uninstall the Workspace ONE Assist application if it was previously installed on the personal side of the device in Android 8, 9, or 10.
    • For Android 8, 9, and 10 devices, the end user must uninstall Workspace ONE Assist from the personal side of the device.
    • For Android 11 devices, the end user must uninstall Workspace ONE Assist from the work profile on the device.

      On Samsung COPE devices, the Personal profile and Work profile can be remote controlled.

Note: On Samsung COPE devices, remote control is disabled by default within All Work Profiles under Android 9.0 (with Knox versions earlier than 3.4.1) and Premium Work Profiles under Android 10.0 or later (with Knox 3.4.1 or later). You can enable remote control on these work profiles by installing the KNOX Service Plug-in together with the appropriate OEM Config policy. For more information, see How Do You Enable Remote Control with Samsung Knox Service Plugin and Full Remote Control Support by Original Equipment Manufacturer (OEM) and Model, Android.

With the introduction of Knox version 3.4.1, Samsung has enabled remote control on non premium Work Profiles by default. This is available on Samsung devices under Android 10.0 and later.

A Knox Premium License is necessary to enable remote control on Work Profiles with Knox versions earlier than 3.4.1.