Getting Started with Workspace ONE XR Hub

VMware Workspace ONE XR Hub is a companion to Workspace ONE Intelligent Hub that provides an enterprise experience and cross-platform native launcher for Virtual Reality (VR) devices. XR hub provides secure and simple access to corporate applications and content on a wide variety of standalone eXtended Reality (XR) devices.

XR Hub works with Workspace ONE UEM to provide secure access to native VR and remote XR applications and shared device check-in/check-out functionality. XR Hub can also be used with Workspace ONE Access to provide advanced authentication and unified application catalog purposes.

Client Components

  • Workspace ONE Intelligent Hub (Intelligent Hub)
    • Provides enterprise device management capabilities.
    • Supports a wide range of smartglasses and augmented, virtual, and mixed reality devices.
  • Workspace ONE XR Hub (XR Hub)
    • Provides a more secure enterprise device experience.
    • Supports Android based Virtual Reality (VR) devices.

Cloud/Server Components

Workspace ONE UEM combined with Workspace ONE Access (optional) provides the best approach enabling your XR device fleet.

  • Workspace ONE UEM (UEM)
    • Manages and secures XR devices for enterprise deployment.
  • Workspace ONE Access (Access), although optional, enables
    • Authentication with Active Directory and 3rd Party Identity Providers.
    • Automated unified catalog including applications published using Access, UEM, and VMware Horizon.

Software Requirements

Software Options

  • See the XR Hub VMware Interoperability Matrix for the current list of supported software versions.
  • Workspace ONE Access for Unified Catalog and advanced authentication options such as Single sign-on (SSO) and Multi Factor Authentication (MFA)
  • Workspace ONE Tunnel for Mobile SSO into third party applications.
  • NVIDIA CloudXR v3.1+ for remote rendering / VR app streaming.
  • VMware Unified Access Gateway (UAG) with Workspace ONE Tunnel for Per App VPN (Tech Preview).
  • VMware Horizon for VDI access (Tech Preview) or scaling a remote rendering solution (Tech Preview).
  • XR Hub Cloud Link for Horizon/CloudXR integration (Tech Preview).

Supported Hardware

See the XR Hub Device Interoperability Matrix for the current list of supported devices.

The following XR devices are compatible with Workspace ONE XR Hub 23.04.

  • HTC VIVE XR Elite™
  • HTC VIVE Focus 3™
  • Meta Quest Pro™
    • Quest for Business (Tech Preview)
  • Meta Quest 2™ (v53+)
    • Quest for Business (Tech Preview)
    • Oculus for Business is not supported
  • PICO 4 Enterprise™
  • PICO Neo 3™ / PICO Neo 3 Pro Eye™

Note: When enrolling a device using Workspace ONE Intelligent Hub, Device Owner admin rights are granted as part of the enrollment process. If this device is later unenrolled from Workspace ONE UEM, a factory reset is automatically performed as part of the unenrollment process, erasing all files and content from the device.

Workspace ONE XR Hub Deployment Options

Before configuring XR Hub, you should understand the different deployment options available.

Recommended: Device Management with Secure Launcher and Unified App Catalog

  • Products: XR Hub, Intelligent Hub client, Workspace ONE UEM, Workspace ONE Access.
  • VR devices are managed with Workspace ONE UEM and Intelligent Hub client.
  • XR Hub is deployed using UEM to managed devices to provide and enterprise experience.
  • XR Hub is integrated with Workspace ONE Access for conditional access, SSO, and advanced authentication flows (MFA).
  • XR Hub is integrated with UEM and Access for Shared Device functionality.
  • XR Hub automatically presents a unified application catalog based on entitlements across UEM, Access, and optionally VMware Horizon.

Minimum: Device Management with Secure Launcher

  • Products: XR Hub, Intelligent Hub client, Workspace ONE UEM.
  • VR devices are managed with Workspace ONE UEM and Intelligent Hub client.
  • XR Hub is deployed using Workspace ONE UEM to managed devices to provide and enterprise experience.
  • XR Hub is integrated with UEM for Shared Device functionality.
  • XR Hub presents application catalog manually defined by administrator in XR Hub configuration.

VR Streaming: Device Management with Secure Launcher, Unified App Catalog, and VR Streaming

  • Products: XR Hub, Intelligent Hub client, XR Hub Cloud Link (optional, Tech Preview), Workspace ONE UEM, Workspace ONE Access, NVIDIA CloudXR, and VMware Horizon (optional, Tech Preview).
  • Same as recommended deployment plus:
    • Workspace ONE Access is used to publish Remote XR applications to XR Hub.
    • NVIDIA CloudXR Server binary is installed on remote VR host machine (PC/VM).
    • NVIDIA CloudXR Client is pushed to client device using UEM.
    • Tech Preview - VMware Horizon with XR Hub Cloud Link for orchestration and SSO.

Enroll VR Devices with Workspace ONE UEM

Managing VR devices with Workspace ONE UEM allows you to remotely control, secure, manage, and support devices. XR Hub must be remotely installed on VR devices managed by UEM. UEM provides additional functionality to XR Hub such as shared device check in / check out, Single Sign-On and remote configuration.

To manage VR devices with UEM, the device must be “enrolled” first. UEM supports manual, scripted, and QR code enrollment for VR device setup and management.

For details on setting up VR devices with Workspace ONE UEM, see https://techzone.vmware.com/resource/extended-reality-xr-device-management-vmware-workspace-one-uem.

Once a device is enrolled into Workspace ONE UEM, XR Hub can be deployed and used on that VR device.

Configure Workspace ONE XR Hub

You must use Workspace ONE UEM to configure and deploy XR Hub. XR Hub must be uploaded as an application to UEM before configuration can take place. It is recommended as a best practice to have a separate organization group (OG) per device vendor. Take the following steps per device vendor (HTC, Meta, PICO).

  1. Visit My Workspace ONE and download the XR Hub file that correspond to your VR device vendor.
  2. In Workspace ONE UEM, move to the parent organization group (OG) that manages the particular VR headset.
  3. Navigate to Resources > Apps > Native and then select the Internal tab.
  4. Select the Add button followed by Application File. The Add Application screen displays.
  5. Select the Upload button to upload the hosted APK file you downloaded in step 1. The Add screen displays. Select the Choose File button and locate the APK file on your system. Once the APK file completes uploading, you are returned to the Add Application screen.
  6. Select the Continue button on the Add Application screen. The Add Application - XR Hub v xx.xx screen displays. The uploaded APK prepopulates all the required fields so you can accept the default values or make customization per your preferences.

    This screenshot shows the SDK profile screen in the Add Application step.

  7. Select the More tab followed by SDK.

  8. For SDK Profile, select Android Default Settings.
  9. Select the Save & Assign button. The XR Hub - Assignment screen displays.
  10. In the Distribution tab, enter the following information.

    This screenshot shows the distribution tab for the application assignment screen in UEM.

    Setting Description
    Name Enter an assignment name for the deployment assignment.
    Description Enter the assignment description.
    Assignment Groups Enter the smart group name(s) for your VR headsets.
    Deployment Begins On For a typical as-soon-as-enrolled deployment use the default value.
    App Delivery Method For a typical as-soon-as-enrolled deployment choose Automatic.
  11. Move to the Restrictions tab, and enable the Managed Access slider.

  12. Move to the Tunnel tab and accept the default selections.
  13. Move to the Application Configuration tab and enable the Send Configuration slider. The Application Configuration screen displays with its full compliment of options. Enter the following information.

    This screenshot shows the entire Application Configuration screen including all options.

    Note about configuring URLs in this section Most options here accepting URLs can instead accept a file based URL that references a file stored locally on the device rather than a web hosted file. The format used must be file:///storage/emulated/0/[path and fileame] for example file:///storage/emulated/0/vmware/company_logo.jpg. Based on the version of Android OS used by the device, there might be limitations on file system access.

    Setting Description
    Workspace ONE Access URL If you are using Workspace ONE Access for user authentication, then THIS URL MUST BE SET TO THE WORKSPACE ONE ACCESS SERVER FQDN (not the Workspace ONE UEM server). Optionally, the end user can enter another URL from within the client at any time by using the Change Workspace One Domain button at the bottom of the login window. Example: https://myvmware.workspaceair.com
    If you are using Workspace ONE Access and this option is not configured, the user will be prompted for the URL (not a recommended user experience).
    Entitlement Refresh (mins) Standard Setting
    Workspace ONE Access entitlements are refreshed manually with the refresh button within the XR Hub Client (top right) and also automatically refreshed with a timed interval. By default, this interval is set to 8 hours (480 minutes) but can be altered using the “entitlementsRefreshMinutes” setting. VMware recommends to leave this interval set to the default value.
    Enable Kiosk Mode (Meta Quest 2 Consumer) Standard Setting
    If you are using the Meta Quest 2 consumer device, set this value to enable so that XR Hub launches on device startup. Refer to Kiosk Mode for Meta Quest 2 for required steps to enable kiosk mode.
    Tutorial Video URL Standard Setting
    Enter the URL of an mp4 video to display first launch of XR Hub and subsequent launches after a user has logged out. If this is left blank, no video is shown.
    Allow Skip Tutorial Standard Setting
    If you are pushing a custom video tutorial to the device to be displayed in XR Hub, you can set this to enable to allow the user to skip the tutorial on first use. Setting it to disable prevents the user from logging in until the video has finished playing.
    Config Entitlements Only THIS OPTION MUST BE ENABLED ONLY WHEN WORKSPACE ONE ACCESS IS NOT USED to specify that the app catalog is defined with client configured entitlements only. This prevents XR Hub from attempting to authenticate with Workspace ONE Access. Shared devices managed by UEM still prompt users to check out a device with username and password if the device is checked in and clientConfigEntitlementsOnly is set to enable.
    In summary,
    Enable this option when you are NOT using Workspace ONE Access.
    Disable this option when you ARE using Workspace ONE Access.
    Show All Installed Applications Standard Setting
    Enable this to show all launchable applications that are installed on the device under the Immersive Apps filter. Note: Some apps, including Intelligent Hub, Tunnel, and XR Hub are automatically filtered out.
    Ignore Shared Device Checkout Standard Setting
    If you have enrolled a device as a shared device but do not want users to checkout the device, set this to enable. This is only relevant to deployments where devices maybe pre-enrolled as shared devices and then moved automatically to another user account.
    Loading Screen Custom Logo URL Standard Setting
    The URL of a logo (image) to display above the spinner animation on the XR Hub loading screen. If this is left blank, no logo is displayed.
    Intro Web Page URL Standard Setting
    The URL of a webpage to display after XR Hub as loaded. If this is blank, no web page is shown.
    Application Window Logo URL Standard Setting
    The URL of a logo (image) to display at the top of the XR Hub application screen. If this is left blank, the logo from the console branding is used.
    Custom Credential Configuration Advanced Setting
    XR Hub can be configured to pass a username or email address to a native application that is launched by XR Hub. This is only required if not using Workspace ONE Access for SSO.

    Click on Configure.
    This screenshot shows the Custom Credential Configuration screen, which you use if you are not using Workspace ONE Access for single sign on.

    The Custom Credential field settings:
    • Enable Custom Credential – if set to Enable, data passes to any native application launched by XR Hub.
    • Is In Extras Key – If set to Enable, the username passes to the application within the ‘extras’ dictionary of the launch intent, otherwise it passes as the ‘data’ parameter with no key.
    • Extras Key - “credential” - if Is In Extras Key is Enable, then this value is the ‘key’ in the ‘extras’ dictionary containing the username.
    • URL Encoded – If set to enable, the URL encodes the credential.
    • Include Group – If set to enable and not using Use Logged In User, then UEM passes back the ‘username’ as ‘group.user’; in some cases (like constructing an email address) the group is not needed (set to disable).
    • Scheme: “creds://” – Prepend credential with a custom scheme if required (for example ‘creds://’).
    • Domain: “vmware.com” – Append a domain at the end of the credential (for example ‘vmware.com’ adds ‘@vmware.com’ to the end).
    • Use Logged In User - If set to enable, the username used is the one used to either login to XR Hub or checkout the device with XR Hub. If set to disable, the username used is the one the device enrolled with. For shared devices, the shared device account (not the checked out user) is returned, if set to disable.
    Enable SSO Standard Setting
    Setting Enable SSO to enable enables SSO. You can stop (Workspace ONE Access) single sign-on to XR Hub by setting this to disable.
    Authorization Profile: Standard Setting
    If you are managing shared devices and the check out process requires Multi-Factor Authentication (MFA) then set this to MFA. If your check out authentication flow only requires username and password set this to SFA for Single Factor Authentication.
    XR Environment Theme Advanced Setting
    Select the environment background you wish to present in XR Hub. For more information, see Customize XR Hub User Experience.
    XR Environment Type Advanced Setting
    Select a type:
    • Default - 360 cubemaps for 3DoF devices and 3D environment for 6DoF devices.
    • 2D / Cubemap - To force a 360 cubemap. The cubemap must be called custom_skybox.png and installed on the device. For more information, see Customize XR Hub User Experience.
    • 3D Environment - To force a 3D environment.
    XR Environment Custom Skybox URL Advanced Setting
    Set to asset url, to override skybox when using Default Office with Custom Logo theme. See Customize XR Hub User Experience.
    XR Environment Custom Models Advanced Setting
    Configure a custom 3D environment or custom 3D logo for XR Hub. The environment theme must be set to Default Office with Custom Logo theme or a custom environment theme. Only one environment model (for a custom environment theme) or one logo model (for the Default Office with Custom Logo theme) can be set.

    Click on Configure to configure the model.

    This screenshot shows the XR Environment Custom Models screen, which you use to configure a custom 3D environment or custom 3D logo for XR Hub.
    For more information, see Customize XR Hub User Experience.
    XR Environment Custom Artwork Advanced Setting
    Specify the URLs for the Top, Left, and Right artwork to show on the back wall when using the Default Office with Custom Logo theme. See Customize XR Hub User Experience.
    Applications Standard Setting
    You can manually define native, web, WebXR, and remote XR applications to appear in the XR Hub application window. If not using Workspace ONE Access, applications must be defined here to appear in the XR Hub application window. Click Configure to add applications.
    This screenshot shows the Applications screen, which you use to manually define native apps, web apps, WebXR and remote XR apps to appear in the XR Hub application.
    The Application field settings are:
    • Application Type – Choose from:
      • Native - An application that is installed on the device and runs locally on the device. Use this if you are not using Workspace ONE Access or there are applications on the device that have not been pushed by Workspace ONE UEM.
      • Web/SaaS - A web site/application launched in the XR Hub in-app browser. Use this method if you are not using Workspace ONE Access. Otherwise, publish Web / SaaS applications using Workspace ONE Access.
      • WebXR - A WebXR application that is launched in the WebXR browser configured with XR Hub. Use this method if you are not using Workspace ONE Access. Otherwise, publish WebXR applications using Workspace ONE Access. See the section Publish WebXR Applications to XR Hub.
    • Application Name – This is required for all applications and is the application name you wish to appear in the XR Hub application window.
    • BundleID - The Android bundle ID for a native application installed on the device for example com.company.application.
    • URL – This is required for Web / SaaS and WebXR application URLs.
    • IP Address – This is required for Remote XR applications and is the IP address of the Windows machine hosting the CloudXR application. This machine should be actively running SteamVR with the CloudXR runtime.
    CloudXR Windows Client Path Advanced Setting
    Not applicable for the current version of XR Hub.
    CloudXR Android Client Bundle ID Advanced Setting
    If accessing CloudXR applications with VMware Horizon, Workspace ONE Access, or manually defined Remote XR applications, then define the bundle ID of the CloudXR client you push to the XR device. For example, com.nvidia.cloudxr.ovr.
    Entitlement Filters Standard Setting
    Using entitlement filters you can hide or ensure applications are shown first in the XR Hub application window. Click Configure to add entitlement filters.
    This screenshot shows the Entitlement Filters screen, which you use to identify which apps should be hidden or shown in the XR Hub application.
    The Entitlement Filter settings are:
    • Entitlement Type - Choose from:
      • Hidden - Hides the specified application from showing in the XR Hub application window. Useful for hiding a WebXR browser application, 2D applications or other non-user applications pushed to devices.
      • Type Priority - These applications show first and on every page for their specific application type (Immersive, Browser, Horizon)
      • Global Priority - These application show first and on every page despite the type of application chosen (Immersive, Browser, Horizon)
    • Application Name – The name of the application, as displayed in the XR Hub application window.
    Firmware Updates Not currently supported with this version of XR Hub.
    Max Window Drag Height Advanced Setting
    Use this to specify how high a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    Min Window Push Distance Advanced Setting
    Use this to specify how close a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    Max Window Push Distance Advanced Setting
    Use this to specify how far away a user may drag UI windows within the XR Hub environment. This is useful when using a custom made environment.
    StyleSheet URLs Advanced Setting
    Specify the URL of the StyleSheet used to configure the color scheme of XR Hub. See Customize XR Hub User Experience.
    WebXR Browser Configuration Advanced Setting
    This setting enables you to define what WebXR browser or package should be used to launch WebXR applications from XR Hub. It should be noted that any browser or application should be configured for Single Sign-On (SSO) to avoid the user from being presented with a Workspace ONE password login flow (if using Workspace ONE Access). Click Configure to configure a WebXR browser.

    The settings below can be used for the Wolvic VR Browser on Meta Quest:

    This partial screenshot shows the WebXR Browser Configuration screen, which enables you to define your preferred 3rd party browser, in this case Wolvic VR Browser, for launching WebXR applications.

    The following settings can be used for Mozilla Firefox browser on PICO or VIVE Focus devices:

    This partial screenshot shows the WebXR Browser Configuration screen, which enables you to define your preferred 3rd party browser, in this case Mozilla Firefox Browser, for launching WebXR applications.
  14. Select Create.

  15. Select Add Assignment to add new app assignments for your application.
  16. Configure flexible deployment settings for your application by editing the schedules and priority for your deployments. Options that are displayed on this window are platform-specific.

    Setting Description
    Copy From the ellipses-vertical, you can click copy if you choose to duplicate the assignment configurations.
    Delete From the ellipses-vertical, you can delete to remove the selected assignment from the application deployment.
    Priority You can modify the priority of the assignment you configured. Priority is from 0 to N with 0 being the highest priority. For a typical as-soon-as-enrolled deployment, this is set to 0.
    Assignment Name View the assignment name. Click for details.
    Description View the assignment description.
    Smart Groups View the assigned smart group. Click for details.
    App Delivery Method View how the application pushes to devices. Auto pushes immediately through the Workspace ONE UEM Catalog with no user interaction. On Demand pushes to devices when the user initiates an installation from a catalog.
    EMM Managed Access View whether the application has adaptive management enabled.
  17. Select the Exclusions tab and enter smart groups, organization groups, and user groups you want to exclude from receiving this application.

    • The system applies exclusions from application assignments at the application level.
    • Consider the organization group (OG) hierarchy when adding exclusions. Exclusions at a parent OG do not apply to the devices at the child OG.
    • Exclusions at a child OG do not apply to the devices at the parent OG. Add exclusions at the desired OG.
  18. Select Save & Publish.

Edit an Existing XR Hub Configuration

You can make changes to an XR Hub configuration that is already uploaded or assigned.

Any changes made to the application configuration are pushed to devices automatically. Users are alerted to the fact that a new configuration is available and they are asked to restart XR Hub from the users menu.

  1. In Workspace ONE UEM, move to the organization group (OG) that manages your headsets.
  2. Navigate to Resources > Apps > Native and select the Internal tab.
  3. Locate the XR Hub app from the listing. If you have many apps in this listing, an easy way to locate it is to enter “XR Hub” in the Search List text box to the far right, then press enter.
  4. Click the edit icon (this partial screenshot shows the radio button select together with the pencil edit icon with a mouse pointer for scale.) to the left of the listing for XR Hub. The Edit Application - XR Hub screen displays.
  5. You can make changes on this Details tab or other tabs on this screen. When you are done, select the Save & Assign button. The XR Hub - Assignment screen displays.
  6. Select the link under the *Assignment Name column heading. The Distribution tab for the XR Hub - Assignment screen displays.
  7. You can make changes to this tab or other tabs including Application Configuration. For detailed documentation on Application Configuration, see step 13 in XR Hub Configuration options.

Configure Workspace ONE Access for XR Hub

Using Workspace ONE Access is the recommended approach when deploying XR Hub as it provides you the ability to publish any Workspace ONE UEM, Workspace ONE Access, or Horizon managed applications to the XR Hub application launcher. In addition, Workspace ONE Access integration enables advanced authentication flows such as third-party identity providers (Okta, Ping, Active Directory, Azure Active Directory), conditional access, Single Sign-On (SSO), Multi-Factor Authentication, and so on.

For more information, see Configuring Authentication Methods in VMware Workspace ONE Access.

Configuring Workspace ONE XR Hub in this way informs Workspace ONE Access that any XR Hub Client is a trusted client for authentication purposes. The following instructions enable you to register the XR Hub Client Template ID and redirect URI with Workspace ONE Access.

  1. Log in to the Workspace ONE Access admin console using your tenant admin account.

    This screenshot shows the Templates tab in OAuth 2.0 management Settings in Workspace ONE Access console, with the Add Template button highlighted.

  2. Select Settings.

  3. Select OAth 2.0 Management.
  4. Select the Templates tab.
  5. Select the Add Template button. The Create Template dialog box displays.

    This dialog box allows you to enter the XR Hub Client Template ID and Redirect URI. It also lets you choose what types of information (Scopes) your app requests from Workspace ONE Access and the user during End User Authentication.

    This screenshot shows the Create Template screen, enabling you to define a template for remote app access.

    • Template ID: Enter XR_Hub as the Template ID for the XR Hub. This is required to request an instance-specific Client ID and Secret from Workspace ONE Access.
    • Scope: Choose the kind of information Workspace ONE Access sends to the XR Hub Client by default. Enable only the following scopes.
      • Email: This allows Workspace ONE Access to grant the XR Hub Client information about the user’s email. The email verified attribute indicates whether the user’s email is verified as belonging to the user.
      • Profile: This lets Workspace ONE Access provide the user’s information. The family name attribute provides the user’s last name and the given name attribute provides their first name.
      • User: This lets Workspace ONE Access know that the XR Hub Client needs access to user information.
      • OpenID: This lets Workspace ONE Access know that it should send your app an ID Token after end-user authentication.
    • Redirect URI: Enter the redirection endpoint Workspace ONE Access uses to respond to the XR Hub’s requests, http://localhost:3000/
      • The trailing / must be included in the URL.
  6. Select the Save button to register the XR Hub. You can begin using the XR Hub with Workspace ONE Access.

Enable XR Hub with Read/Write Permissions on Meta Quest 2

If deploying custom assets or files to Meta Quest 2 devices with Workspace ONE UEM, then XR Hub must be explicitly given Read/Write permissions to access files pushed by UEM.

  1. In the Workspace ONE UEM console, navigate to Resources > Profiles & Baselines > Profiles.
  2. Select Add > Add Profile, then select Android as the platform.

    This screenshot shows the Android device profile config screen with code specifically designed to grant Meta Quest 2 devices read-write capabilities.

  3. Give a name for the profile such as XR Hub Read/Write Permissions.

  4. Scroll down and select Custom Settings and select ADD to enable editing.
  5. Enter the following in the Custom Settings text field:

    <characteristic uuid="ece876fd-da7d-424f-9bab-85a1b483e95e"  type="com.airwatch.android.androidwork.permissions" target="1">
      <parm name="MasterRuntimePermission" value="1" type="integer" />
      <parm name="AppLevelRuntimePermissions" value="W3sicGFja2FnZU5hbWUiOiJjb20udm13YXJlLnhyLnhyaHViLnF1ZXN0IiwicGVybWlzc2lvbnMiOlt7Im5hbWUiOiJhbmRyb2lkLnBlcm1pc3Npb24uUkVBRF9FWFRFUk5BTF9TVE9SQUdFIiwidmFsdWUiOiIwIn0seyJuYW1lIjoiYW5kcm9pZC5wZXJtaXNzaW9uLldSSVRFX0VYVEVSTkFMX1NUT1JBR0UiLCJ2YWx1ZSI6IjAifV19XQ==" type="string" />
    </characteristic>
    
  6. Select Next

  7. For Smart Group, select the VR headset smart group(s) to be assigned.
  8. Select Save and Publish.

Additionally, you must grant All File Access permission to the Workspace ONE Intelligent Hub client. For more information, see https://techzone.vmware.com/resource/extended-reality-xr-device-management-vmware-workspace-one-uem.

Enable XR Hub Kiosk Mode

You can configure a VR device to automatically launch XR Hub at device boot.

The process to set up Workspace ONE XR Hub as the first app to launch differs between supported headsets.

Note: For Meta Quest devices, the configuration must be done as part of staging, before the device is sent to the user.

HTC

Kiosk mode for the HTC VIVE Focus 3 and XR Elite requires pushing an xml configuration file to the device and running an Intent to trigger it.

  1. In the Workspace ONE UEM console, move to the organization group (OG) that manages your headsets.
  2. Navigate to Devices > Provisioning > Components > Conditions.

    a. Click the ADD CONDITION button, then select Android as the platform. The Create Condition screen displays.

    b. Complete the Condition Settings.

    Setting Value
    Name XR Hub for HTC
    Description XR Hub for HTC is installed
    Condition File

    c. Select the Next button.

    d. Enter the Condition Details

    Setting Value
    File Name /$internal$/Android/data/com.vmware.xr.xrhub.wavevr
    Condition Met When File Found
    Frequency 15 minutes
    Duration 1 Day
    After Duration Exceeded Pass Condition

    e. Select the Save button.

  3. Navigate to Devices > Provisioning > Components > Files/Actions.

    a. Use the ADD FILES/ACTIONS button at the top of the page to create a new File/Action.

    b. Select Android.

    c. Configure the General Tab

    Setting Value
    Name Download HTC XML Config
    Description Optional description.
    Managed By Prepopulated with the correct OG.

    d. Move to the Files tab and select ADD FILES.

    e. Select Choose Files and upload a copy of the mns.xml file shown below, after the last step.

    f. Select Save to save the file.

    g. Specify the download path as $internal$/VMware and select Save to save the configuration.

    h. Move to the Manifest tab.

    i. Select ADD ACTION under the Installation Manifest section.

    j. In the Action(s) To Perform drop-down, select Run Intent.

    k. For Command Line and Arguments to run, enter

    mode=explicit,broadcast=false,action=com.htc.vr.launcher.SCENE,package=com.htc.vrs.launcher,class=com.htc.vr.unity.WVRUnityVRActivity,extraString=LaunchScene=UpdateKioskMode

    l. Select Save to save the Files/Action.

  4. Navigate to Devices > Provisioning > Product List View.

    a. Select Add Product and select Android.

    b. Configure the General tab.

    Setting Value
    Name HTC Kiosk Mode Config
    Description Optional description.
    Managed By Prepopulated with the correct OG.
    Smart Groups Enter the Smart Group(s) that the product is applied to.

    c. Move to the Manifest tab, select the +Add button, and configure the following.

    Setting Value
    Actions(s) to Perform File/Action - Install
    Files/Actions Select the File/Action created above, called “Download HTC XML Config”

    d. Move to the Conditions tab and select Add for Install Conditions.

    e. In the dropdown list box, select the Condition you created above, named “XR Hub for HTC”.

    f. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the Product an active status.

    If you want to activate the product later, navigate to the Product List View page, locate the “HTC Kiosk Mode Config” product from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

Kiosk mode XML file - mns.xml

<?xml version="1.0" encoding="UTF-8"?>
<customization_form>
  <category name="application">
    <module name="vive_kiosk_enabler">
      <function name="enable_kiosk_mode">
        <set name="single">
		<!-- 
		     1:enable kiosk mode. 
		     0: disable kiosk mode
		-->
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
      <function name="kiosk_mode_key">
        <set name="single">
		<!-- [TO DO] Enter a passcode to leave kiosk mode. Needs to be a 4 digit number. Empty means no passcode to leave Kiosk mode -->
          <item name="key" type="int">0000</item>
        </set>
      </function>
	  <!-- allow BT connection or not -->
      <function name="allow_bt_connection">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow headset screen casting not -->
      <function name="enable_screen_casting">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow screen capture or not -->
      <function name="kiosk_screen_captured_enable">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- allow USB file transfer or not -->
      <function name="allow_usb_transfer">
        <set name="single">
          <item name="enabled" type="bool">1</item>
        </set>
      </function>
	  <!-- setup application in kiosk mode -->
      <function name="kiosk_mode_apps">
        <set name="plenty">
          <item name="app_name">XR Hub</item>
          <item name="app_package_name">com.vmware.xr.xrhub.wavevr</item>
        </set>
      </function>
	  <!-- kiosk mode type 
	       "1" for Single app
           "2" for Multiple app 
      -->
      <function name="kiosk_mode_type">
        <set name="single">
          <item name="enabled" type="int">1</item>
        </set>
      </function>
	  <!-- Network permission under kiosk mode
			"1" for Offline
			"2" for Pre-defined Wifi
			"3" for Allow to any Wifi
      -->
      <function name="allow_network_permission">
        <set name="single">
          <item name="mode" type="int">3</item>
        </set>
      </function>
	  <!-- require sign in mandatory when entering kiosk mode -->
      <function name="enable_kiosk_mode_signin">
        <set name="single">
          <item name="enabled" type="bool">0</item>
        </set>
      </function>
	  <!-- Interaction method
			"1" for hand only
			"2" for controller only
			"3" for controller & hand
      -->
      <function name="kiosk_InteractionMode">
        <set name="single">
          <item name="mode" type="int">3</item>
        </set>
      </function>
	  <!-- play tutorial when re-start kiosk mode -->
      <function name="kiosk_auto_play_tutorial">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
	  <!-- play opening video when re-start kiosk mode -->
      <function name="kiosk_cinematic_playback">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
	  <!-- play wearing guide when re-start kiosk mode -->
      <function name="kiosk_auto_play_wearing_guide">
        <set name="single">
          <item name="mode" type="bool">0</item>
        </set>
      </function>
    </module>
  </category>
</customization_form>

PICO

Kiosk mode can be configured on Pico devices by pushing a configuration file to the device.

  1. In the Workspace ONE UEM console, move to the organization group (OG) that manages your headsets.
  2. Navigate to Devices > Provisioning > Components > Files/Actions.

    a. Select the ADD FILES/ACTIONS button at the top of the page and Select Android.

    b. Configure the General Tab

    Setting Value
    Name Download HTC XMl Config
    Description Optional description
    Managed By Prepopulated with the correct OG.

    c. Move to the Files tab and select the +ADD FILES button. Select Choose Files and upload a text file called config.txt with the following contents, then select Save.

    open_guide:1
    ------
    home_pkg:com.vmware.xr.xrhub.picovr
    ------
    
    1. Specify the download path as $internal$/VMware, then select the Save button.
  3. In the Workspace ONE UEM console, navigate to Devices > Provisioning > Product List View.

    a. Select the ADD PRODUCT button at the top of the page and select Android.

    b. Configure the General tab

    Setting Value
    Name PICO Kiosk Mode Config
    Description Optional description.
    Managed By Prepopulated with the correct OG.
    Smart Groups Enter the Smart Group(s) that the product is applied to.

    c. Move to the Manifest tab and select the +ADD button to add a manifest using these settings.

    Setting Value
    Actions(s) to Perform File/Action - Install
    Files/Actions Select the File/Action created in step 2 above.

    d. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the product an active status.

    If you want to activate the product later, navigate to the Product List View page, locate the “PICO Kiosk Mode Config” product from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

  4. Reboot the device for it to take effect

Meta Quest (Tech Preview)

At time of writing, native Kiosk mode is not available for Meta Quest devices. VMware implements some of the typical Kiosk mode functionality into XR Hub but the following limitations should be noted.

  • Kiosk Mode requires “developer mode” access to the device in order to run ADB commands.
  • XR Hub requires delegated administration rights from Workspace ONE UEM.
  • There might be a delay between device boot and triggering of kiosk mode.
  • Access to WiFi and Bluetooth settings are blocked after kiosk mode is triggered.

Give XR Hub delegated administration rights via a device profile.

  1. In the Workspace ONE UEM console, navigate to to Resources > Profiles & Baselines > Profiles.
  2. Select Add > Add Profile, then select Android as the platform.
  3. Give a name for the profile such as “XR Hub Delegated Admin”.
  4. Scroll down and select Custom Setting, then select ADD to enable editing.
  5. Enter the following in the Custom Settings text field:

    <characteristic uuid="ee0cdec3-e7c3-4aa6-a8c0-3f3b12fde2sc" type="com.airwatch.android.androidwork.delegatedScopes">
    <parm name="delegationAppRestrictions" value="True" />
    <parm name="delegationAppRestrictionsAppName" value="XR Hub" type="string" />
    <parm name="delegationAppRestrictionsAppId" value="com.vmware.xr.xrhub.quest" type="string" />
    <parm name="delegationPermissionGrant" value="True" />
    <parm name="delegationPermissionGrantAppName" value="XR Hub"  type="string" />
    <parm name="delegationPermissionGrantAppId" value="com.vmware.xr.xrhub.quest" type="string" />
    <parm name="delegationPackageAccess" value="True" />
    <parm name="delegationPackageAccessAppName" value="XR Hub"  type="string" />
    <parm name="delegationPackageAccessAppId" value="com.vmware.xr.xrhub.quest" type="string" />
    </characteristic>
    
  6. Select Next

  7. For Smart Group select the VR headset smart group(s) to be assigned.
  8. Select Save and Publish.

Run ADB commands to allow Kiosk Mode

The Meta Quest device must be in developer mode, see https://techzone.vmware.com/resource/extended-reality-xr-device-management-vmware-workspace-one-uem.

  • After XR Hub is installed and the device is in developer mode, run the following ADB commands to allow XR Hub to run as a kiosk mode application.

    adb -d shell pm grant com.vmware.xr.xrhub.quest android.permission.SYSTEM_ALERT_WINDOW
    
    adb -d shell pm grant com.vmware.xr.xrhub.quest android.permission.READ_LOGS 
    
  • Ensure the setting Enable Kiosk Mode (Meta Quest 2 Consumer) is enabled in the XR Hub application configuration.

After Enabling Kiosk Mode: - Ensure the device is set up with Wi-Fi network access prior to launching XR Hub. - XR Hub must be launched at least once, to recieve the kiosk mode configuration, and trigger the kiosk mode functionality. - On reboot, XR Hub launches automatically and prevents the user from accessing the Quest Home, system settings, or other applications. - To disable Kiosk Mode, disable the Kiosk Mode setting in the XR Hub application configuration and push to the device.

Deploy XR Hub Related Files to Devices Using UEM

Workspace ONE UEM can push files to XR devices using the Product Provisioning functionality. “Product” in this case is referring to the files/actions that are grouped together with deployment rules.

Note: For Android 11+ based devices, some file system locations may be inaccessible to either Workspace ONE Intelligent Hub (which places the files on the device) or to the application that is attempting to read these files. For example, Android 12 based devices (Meta Quest) restrict access to application folders such as Android/data and Android/obb. Ensure that you grant All File Access permission to the Workspace ONE Intelligent Hub client. For more information, see https://techzone.vmware.com/resource/extended-reality-xr-device-management-vmware-workspace-one-uem.

  1. While logged into Workspace ONE UEM, move to the Organization Group (OG) that manages your headsets.
  2. Navigate to Devices > Provisioning > Components > Files/Actions and select the Add Files/Actions button followed by Android as the platform. The Add Files/Actions screen displays.

    a. Complete the General tab.

    Setting Value
    Name Descriptive name of the file being sent to the device.
    Description Optional description of the file being sent to the device.
    Managed By Prepopulated with the correct OG.

    b. Move to the Files tab.

    c. Select the Add Files button. The Add Files window displays.

    d. Select Choose Files and browse for the file you want to deploy.

    • (Optional) You can select more than one file to include in the Files/Action.

    e. Select Save to upload the selected file(s).

    f. Specify the Download Path such as $internal$/VMware/foldername and click Save.

    Note: When pushing custom files for XR Hub to a device, you must ensure that the XR Hub application configuration is pointing to the corresponding location of any custom file. For example, ensure that any custom model, artwork etc is configured in the XR Hub application configuration to point to the location where the custom file is deployed. We recommend pushing files to the following location:

    /$internal$/vmware/folder/filename
    

    Note: - If you selected multiple files, you can specify a distinct Download Path for each file. - If the path entered does not exist on the device, the installation creates the folder structure. - If you support more than one model headset, then you must create separate File-Actions attached to separate products, one for each model. - If you have at least one file uploaded, you do not require a Manifest Action.

  3. Navigate to Devices > Provisioning > Product List View and select the Add Product button followed by Android as the platform.

    a. In the General tab, apply the following settings.

    Setting Value
    Name Provide a name for the product that you can recognize and pick from a list later on.
    Description Optional description.
    Managed By Prepopulated with the correct OG.
    Smart Groups Enter the Smart Group(s) that the product applies to.

    c. In the Manifest tab, select the +ADD button and configure the manifest with the following settings.

    Setting Value
    Actions(s) to Perform Select “File/Action - Install”.
    Files/Actions Select the File/Action created in step 2 above.

    d. Select the Save button to save the manifest to the product.

    e. Select the Save button to save the product. If ready to activate Kiosk Mode, select the Activate button to give the product an active status.

    If you want to activate a saved product later, navigate to the Product List View page, locate the name of the product (from step 3a above) from the listing, select the grey indicator next to the red traffic light for the product. The grey indicator turns green and the red indicator turns grey to indicate that the product is now active.

Disable the Default Launcher in UEM

If using XR Hub with devices enrolled as multi-user (shared devices) or single-user staging accounts, Workspace ONE UEM automatically attempts to install and launch Workspace ONE Launcher. However, Launcher interferes with the operation of XR Hub, so it is important to block Launcher from running.

Add an Application Group to disable the default Workspace ONE launcher. This prevents Launcher from launching when booting a shared device.

  1. While logged into Workspace ONE UEM, change to the Organization Group (OG) that manages your headsets.
  2. Navigate to Groups & Settings > Groups > App Groups and select Add Group. The Add Application Group screen displays.

    This screenshot shows the Application Group creation dialog, allowing you to block the Android Launcher.

  3. For Type, select Denylist.

  4. For Platform, select Android.
  5. Under Name, enter “Disable Launcher”.
  6. Select the +Add Application link.

    a. Under Application Name, enter “Launcher”

    b. Under Application ID, enter com.airwatch.lockdown.launcher

  7. Select Next. The Assignment tab displays.

  8. You can accept all the defaults in the Assignment tab. If you followed step 1, the Managed By text box is prepopulated with the correct OG. If you skipped step 1, then, for Managed By, select the name of the OG that manages your headsets.
  9. Select Finish.
check-circle-line exclamation-circle-line close-line
Scroll to top icon