Getting Started with Workspace ONE Cloud Admin Hub

Follow the outlined procedures to get your Workspace ONE Cloud Admin Hub up and running. Access your VMware Cloud console to create and manage user accounts for the hub. Then, you can federate your corporate domain to use your organization’s SSO and identity source to sign-in to VMware Cloud services and the Workspace ONE Cloud Admin Hub.

VMware Cloud product documentation

Find content about VMware Cloud services by accessing What is VMware Cloud. To learn about organization roles and permissions for VMware Cloud services, access Managing Roles and Permissions.

First steps: Log in to VMware Cloud console and access Workspace ONE Cloud Admin Hub

Step 1: Read your service welcome email

After you make your subscription purchase (either through VMware Sales or through your partner) or after you request a trial, VMware sends a service welcome email to the email ID associated with the order or trial request.

1. Find your Welcome to Workspace ONE email that includes your unique service activation link. If you haven’t seen the email, check your spam messages or corporate spam filter. The unique service activation directs you to the VMware Cloud console. It is important to use this service activation link when you log in to the VMware Cloud console for the first time.

   

2. If you still cannot find the email, ask your VMware Sales Specialist or Customer Success Manager to resend the email or to provide you with the service activation link.

Step 2: Log in to your VMware Cloud console

The service activation link provided to you in the welcome email directs you to the VMware Cloud console.

1. Click the service activation link provided to you in the welcome email.

   

2. Use the email and password from your My VMware account to log in. If you do not have a My VMware account, create one and fill in all mandatory fields.

   

Step 3: Join your Workspace ONE Cloud Admin Hub to a VMware Cloud services organization

A Cloud Services Organization is a container for all your services, and VMware Cloud services uses organizations to control access to your cloud services. To access a cloud service, you must belong to an organization. For details about organizations in VMware Cloud services, access the topic How do I manage my Cloud Services Organizations.

To join an organization, attach or join your Workspace ONE Cloud Admin Hub to a Cloud Services Organization so that you can access the Workspace ONE Cloud Admin Hub console.

After logging in to the VMware Cloud services console, you might see a list of organizations that you already have access to. This list can include organizations associated with services outside of Workspace ONE. Having access to organizations associated with and outside of Workspace ONE gives you the option to join your subscription with an existing organization or to create a new organization.

(Option 1): Join to an existing organization

There are several benefits for you as an organization owner to having multiple subscriptions in a single organization.

• Combines multiple Workspace ONE subscriptions into a single view.
• Reduces the number of organizations you manage in VMware Cloud services.

By selecting an existing organization that includes other Workspace ONE service subscriptions, the services you are currently adding combine with services in the existing subscription. You now have a single view of your Workspace ONE services.

For example, if there is an existing subscription for Horizon and Access services and you have a new subscription for Workspace ONE UEM, then selecting the organization that includes Horizon and Access to use for the new UEM subscription combines all subscriptions. The organization now includes Horizon, Access, and UEM in a single view in Workspace ONE.

Considerations

Before you add your current subscription to an existing one, view the considerations to see if this process meets your needs.

• For those instances that must have their Workspace ONE subscriptions managed separately, create a VMware Cloud services organization and do not use an existing one.
• If your new subscription has Workspace ONE UEM, the process of selecting an existing organization that also includes Workspace ONE UEM is not currently supported.
• You cannot select an existing organization that is associated with an expired Workspace ONE subscription. Contact VMware Customer Connect to help with an expiration issue.
• You cannot select an existing organization that is associated with a different region from your region. Contact VMware Customer Connect to help with product region issues.

Procedure

1. Log into the VMware Cloud console. You see a list of organizations, ones that you created for other Workspace ONE subscriptions.
2. Take one of the listed actions.
   • If you see the desired organization in the current list, select the organization and then select to Proceed To Service.
     • Selecting this menu item associates your new subscription with your current Workspace ONE subscriptions in the selected organization.
     • The action directs you to the Workspace ONE Cloud Admin Hub.
   • If you do not see the desired organization in the current list, and you want to see a list of all organizations that you are a member of, select Add Service To Another Org.
     • Selecting this menu item takes you to a list of all organizations of which you are a member. These organizations might or might not be associated with Workspace ONE services.
     • You can select an organization from the list if you are the owner of that organization.
     • Select Continue to associate your new Workspace ONE subscription to the selected organization. The action directs you to the Workspace ONE Cloud Admin Hub.

(Option 2): Create a new VMware Cloud services organization

There are several reason why you create an organization rather than joining to an existing one. Create a new organization in these listed scenarios.

• This subscription is your first Workspace ONE subscription.
• The new subscription requires its own admin management experience.
  • Some Workspace ONE subscriptions are managed by independent admin groups.
  • Admin groups require separate and independent Workspace ONE Cloud Admin Hubs for the subscriptions they manage.
• You want to keep the new subscription segregated for future billing and support reasons.

Procedure

1. Log into the VMware Cloud console.
2. Select Create Organization.
3. Enter a name for the organization.
4. Agree to the terms of service and complete the organization setup.
5. Select Create Organization and Complete Sign-Up. The action directs you to the Workspace ONE Cloud Admin Hub.

Step 4: Access your Workspace ONE services console

Depending on your subscription purchase, you can access one or more Workspace ONE services in the Workspace > My Workspace > Services area.

1. In the Workspace ONE Cloud Admin Hub console (branded as Workspace ONE), select the service you want to access. Each service tile has an SSO capable link and logs you into the respective console.
2. The system creates a user account in the service console using your organization and service role.

Next steps: Account creation, inviting other admins, and federation

The Workspace ONE Cloud Admin Hub console is the main console that provides access to all your Workspace ONE services. When you select the initial activation link and create a Cloud Services Organization, the system creates an account for you with an Organization Owner role.

Workspace ONE Cloud Admin Hub is registered with VMware Cloud services, so you perform many of the initial setup steps for the Workspace ONE Cloud Admin Hub console in the VMware Cloud console.

Working as an Organization Owner in the VMware Cloud console, you can add other organizations, users, and assign these users to service roles within your organizations. You can also set up federation with your corporate domain. Federating your corporate domain allows you to use your organization’s SSO and identity source to sign-in to VMware Cloud services.

Invite new users and assign them organization and service roles

As an organization owner, you can invite additional users to your organization and assign them organization and service roles. Organization roles activates the user as a member of the organization. You can also assign them additional organization roles if applicable. Assigning a service role controls the access permissions (admin or basic) the user has to the organization and to the services within the organization.

Note: Unlike owners, users with organization roles cannot invite others to an organization.

Procedure

1. In the VMware Cloud console, go to Identity and Access Management > Active Users. You see a list of all the users currently in your organization.
2. Select Add Users and complete the Add New Users settings.
3. Enter an email address for each user you want to add, separated by a comma, space, or a new line.
4. Select Organization Member as an organization role (if it is not selected by default) and choose addtional roles if desired.
5. In the Assign Service Roles area, select + Add a Service.
6. Select Workspace ONE from the drop-down, and select a service role.
   • Admin: Provides full access to Workspace ONE Cloud Admin Hub and provides access to all entitled Workspace ONE services.
   • Basic: Provides read-only access to Workspace ONE Cloud Admin Hub and provides read-only access to all entitled Workspace ONE services.
   • With: Allows the user to keep the service role indefinitely.
   • Until: Restricts how long the user can access the permissions in the service role to an end date you configure.
7. Select Send emails to all invited users notifying them of this role assignment. Email recipients can use these emails to activate their accounts.
8. Select Add to complete the process.

Federate user access to VMware Cloud

Enable single sign-on for your users to access VMware Cloud services by federating multiple corporate domains. Use a self-service workflow to configure federation with VMware Cloud services in the Workspace ONE Cloud Admin Hub, the Getting Started section. The workflow supports integration with SAML 2.0 based identity providers. To learn more about the federation process, access What is enterprise federation and how does it work.

Procedure

Setting up Enterprise Federation is a highly secure task so we have created a special role for this task. It is called the Enterprise Administrator role. As an organization owner, you must invite and assign someone to fill this roll. This person must have permissions to manage your corporate Active Directory or identity provider system. You can invite yourself if that person is you.

1. In the Workspace ONE Cloud Admin Hub console, go to My Workspace and scroll down to the Getting Started area.
2. Select View All.
3. In the Begin with the basics area, select the SET UP link for the Federate access to VMware Cloud Services process.
4. Enter the email address of the person who manages your corporate Active Directory or identity provider system.
5. The person who manages your corporate Active Directory or identity provider system accepts the invitation and is now the Enterprise Administrator. The system navigates the person to a sign-up page for VMware Cloud services.
6. The Enterprise Administrator signs into VMware Cloud services.
7. The Enterprise Administrator can start the federation flow following these steps.
   1. Verify your domains and sub-domains.
   2. Install a connector that connects to your on-premises Active Directory system.
   3. Sync users and groups.
   4. Configure your identity provider.
   5. Validate and finish set up.

Results

Your admin users can use your corporate identity to access VMware Cloud services.

Workspace ONE Service discovery

Workspace ONE Cloud Admin Hub provides easy access to each of the Workspace ONE services you have purchased. It also allows you to discover and learn more about other services.

Access Your service console

Workspace ONE Cloud Admin Hub provides access to Workspace ONE service consoles through the Workspace > My Workspace page. The service tiles you see when you select the My Services filter are the services you are entitled to use based on your subscription purchases. These service tiles are SSO enabled links. They sign you into your service console using the same identity you established with VMware Cloud services. To log in, select the tile and the system logs you into your service console.

Discover additional Workspace ONE services

You can discover additional Workspace ONE services under using the Available Services filter. You can select Learn More to explore these other services. Some of these services may also provide free trials that offer a hands-on experience. Use the free trials to validate your use cases. Contact VMware Sales or your partner if you are interested in any of these other services.

Find services on the Getting Started page

Find many helpful guides to get started with various Workspace ONE services on the Getting Started page. The information is divided into different sections to help you navigate admin functions. The sections help you best use the resources you have with Workspace ONE.

To access the Getting Started page, use your My Workspace page.

1. In the Workspace ONE Cloud Admin Hub, go to Workspace > My Workspace and scroll down to the Getting Started area.
2. Select View All.

The page displays processes available to you depending on your Workspace ONE subscriptions.