You can configure Workspace ONE UEM to manage your corporate owned Android devices that are enrolled and deployed within a closed network. A closed network here refers to one in which devices cannot connect to Google services. The environment can simply be an intranet or deployment in a region where Google services are not available. This page covers corporate-owned device deployments on a closed network, not BYOD devices.
How it works
When enrolling a Work Managed device, the Intelligent Hub adds a managed Google account to the device. The managed Google account is used to push public applications and related policies through the Managed Play Store.
When Workspace ONE UEM is set up for a closed network deployment, the managed Google account is not added on the device. Therefore, devices need not connect to Google to complete enrollment. Profiles (with the exception of Public App Auto Update), Products, and Internal Applications (uploaded to the Workspace ONE UEM console) can be pushed to the device since these resources are delivered from Workspace ONE to the device directly without Google connectivity.
Closed Network Considerations
When deploying corporate owned devices on a closed network without connection to Google services, consider the following:
Barcode Staging - Zebra only
For organizations managing Zebra devices, Barcode Staging enrollment methods using the StageNow are supported in closed networks.
If your organization deploys applications only through Product Provisioning, there are no additional PAC file setup requirements.
If your organization deploys applications uploaded to the Apps & Books > Applications section of the Workspace ONE UEM Console:
QR Code Enrollment
For all other devices, the only supported enrollment method is QR Code enrollment. Organizations using this method need to meet the following requirements:
The Workspace ONE UEM Console configuation varies based on whether all or some of your Android devices are connected to a closed network.
If all managed Android devices are connected to a closed network
You do not need to complete the Android EMM Registration. This configuration may apply to organizations operating in areas with restricted access to Google services, such as China.
If some managed Android devices are connected to a closed network
Configure Workspace ONE to enroll Work Managed devices without a Google account in a specific Organization Group. The instructions below assume that you already setup Android Enterprise by registering with Google using Managed Google Accounts.
VMware AirWatch Cloud Messaging (AWCM) provides secure communication to your back-end systems with the VMware AirWatch Cloud Connector (ACC). The ACC uses AWCM to securely communicate with Workspace ONE UEM powered by AirWatch. AWCM streamlines the delivery of messages and commands from the UEM console to devices by eliminating the need for end users to access the public Internet or use consumer accounts, such as Google IDs. AWCM serves as a comprehensive substitute for Firebase Cloud Messaging (FCM) for Android devices when operating within a closed network. Detailed installation guidance is available here.
Once AWCM has been installed: