Businesses and organizations have turned to Apple iOS devices to improve the employee
experience for frontline workers, such as shift workers in warehouses, customer facing
retail staff, and medical personnel in healthcare.
Using Workspace ONE UEM and Intelligent Hub, you can allow your frontline workers to check
in and check out iOS devices and customize the employee experience by giving users access
to their specific apps and data.
In this tutorial, I'm going to show you how to use Workspace ONE UEM to turn an iOS device,
like this iPad Mini, into a shared device that can be checked in and checked out by
your employees.
There are a few things that you need to have configured prior to performing the steps in
this tutorial.
You’ll need to have a supervised iOS device with Intelligent Hub installed.
You need user accounts added to the Workspace ONE UEM console.
These will be the accounts of users who will be sharing the iOS device.
These can be basic users, directory users, or SAML users using Workspace ONE Access.
You will need to have a smart group configured in Workspace ONE UEM for those users.
Apple Business Manager needs to be configured in your Workspace ONE UEM environment.
And you need to have any profiles configured that you want applied to the iOS devices and
those profiles need to be accordingly assigned.
One final thing.
You will be creating a multi-staging user account in Workspace ONE UEM for enrolling
the shared iOS device.
This account will require a valid email address.
You can use your own email, or another address, whichever you prefer.
Just keep in mind it will be required when you create the account.
For this tutorial, I will not be covering the steps to fulfill these pre-requisites.
To get started, you need to create a multi-staging user account.
Log into the Workspace ONE UEM console.
Select Accounts, then Users, and click on List View.
From the Add dropdown, select Add user.
In the General tab, Start by setting the Security Type to Basic.
Enter the username, the user’s full name, email address, and password.
Switch to the Advanced tab, and scroll down until you see Staging.
Expand the Staging section and click Enabled.
Then click enabled next to Multiuser Devices.
Then click save.
Now you need to configure Automated Device Enrollment.
Go to Groups and Settings and click on All Settings.
Then select Devices and Users.
Then Apple, and finally Device enrollment program.
You will create an Automated Device Enrollment profile by clicking Add Profile.
Be sure to turn Authentication off.
Select Multiuser device from the Staging Mode dropdown and select the user account you just
created for the Default Staging User.
Keep in mind that Profile name, Department, and Support Number are required fields.
You'll need to enter values into them before saving the profile.
Now you need to assign devices to this profile.
To do so, you need to click the Edit Assignment button.
You’ll see a link to download the template for this batch type.
Download the template and create a CSV file by adding the serial numbers of the devices
that will be shared.
The template contains example serial numbers to give you guidance on how to format the
file.
You will then upload the CSV file by clicking the Choose File button, selecting the file,
and clicking OK.
Then click Save.
Next you will need to configure the shared device settings in Workspace ONE UEM.
You can do this in Groups and Settings.
Click on All Settings, then Devices and Users.
You’ll find the Shared Device settings under General.
You can specify how the group assignment is handled.
For the purpose of this video, I'm going to select Fixed Organization Group.
You may also want to configure auto logout.
This will ensure the device is logged out after a specified period in time, in case
someone forgot to check the device back in.
You might also want to set the device in iOS Single App Mode.
This will ensure that Intelligent Hub is the only app accessible until a user logs in.
No other apps or settings will be available until a user logs in through Intelligent Hub.
Let's jump over to an iOS device.
You'll initiate the enrollment process.
When prompted, enter the multi-staging user you created earlier.
You'll follow the prompts in Intelligent Hub to complete the enrollment.
For the purpose of this video, I'm going to jump ahead to the completed enrollment process.
When prompted, you can log into Intelligent Hub with a user account.
This can be a test account or one of the user accounts that will be used on this device.
I've created a few profiles for the users that will use this device as examples of how
you can customize the user experience.
You'll notice that the user currently logged in is assigned access to Microsoft Word.
You'll also notice that the dock for this user is configured with the Mail app and Safari.
Now, Let's log out of Intelligent Hub.
And log in with another user.
You'll notice that this new user has access to the Gmail app and Workspace ONE Web in
Intelligent Hub, but not Word like the other user.
And if we take a look at the dock, you'll notice that this user has been configured
with Safari, Contacts, and Facetime.
One thing to note about Workspace ONE UEM shared iOS devices.
Any app that requires user authentication will not be logged out automatically from
the shared device when the device is checked in.
It is important that users log out of all of their apps before they check in their shared
iOS device.
Let's log out of Intelligent Hub again.
You'll notice that Intelligent Hub is the only app accessible on the iOS device right
now.
Even swiping up does not give me access to the dock or any other applications.
This device will remain at this screen until another user logs in.
For more Workspace ONE UEM technical resources, be sure to visit techzone.vmware.com.