Workspace ONE UEM setup for Zebra and other rugged Android devices

Workspace ONE UEM enrolls our rugged Android mobile computers as company-owned devices, locks them down with Workspace ONE Launcher and works with Zebra's staging and update tools. Omnissa is the former VMware End-User Computing business; the product kept the Workspace ONE name.

Before you start

Omnissa documents Android 8 to 16; devices need direct connections to Google's endpoints. Shared company devices enroll in Work Managed (fully managed) mode, where unenrolling triggers a factory reset. Omnissa's overview lists this mode only for the Custom DPC management type; Android Management API (AMAPI) is for COPE devices on Android 11 and later. Only Custom DPC supports StageNow and the Hub identifier.

Which enrollment method to choose

For zero-touch, ask your reseller whether it can register your devices. Background: Android Enterprise enrollment for rugged devices.

Video: Omnissa

Set the enrollment mode

Go to Groups & Settings › All Settings › Devices & Users › Android › Android EMM Registration. Console menus change between versions.

1. Select your organization group and open the Enrollment Restrictions tab.
2. Set Current Setting to Override and choose Always use Android, so Zebra StageNow enrollment uses Device Owner (Work Managed) mode.
3. For zero-touch, open Zero-touch on the same page, set the default enrollment settings and select Link Zero-touch.

Create the enrollment QR code

1. Go to Devices › Lifecycle › Staging › Mobile Staging and select Configure Enrollment.
2. Choose Platform Android, the management type (Custom DPC or Android Management API) and Enrollment QR Code.
3. Optionally add Wi-Fi details, then choose the organization group and login credentials, for example a staging user.
4. On the Summary page, view the QR code or download it as a PDF.

Enroll the device

Start from a new or factory-reset device without a Google account (Zebra reset guide; for other brands see your model's troubleshooting guide, for example Memor K20/K25).

• QR code: Google documents that tapping the first setup screen six times in the same spot opens the QR reader. Scan the code; with Custom DPC the device downloads Intelligent Hub and enrolls.
• Hub identifier: tap Get Started, connect to Wi-Fi, enter afw#hub when asked to add a Google account and tap Install. In Intelligent Hub, use your email address, a QR code or the server, Group ID and credentials.
• Zero-touch: switch the device on and connect it. Omnissa notes that a device registered for zero-touch may only enroll that way; other methods make it reset itself.
• Zebra StageNow: create the barcode on the console's Generate Stage Now Barcode screen. On the device, finish the setup wizard without a Google account, open the StageNow app and scan the barcode. On Android 13 and later, Zebra's release notes say a StageNow barcode doesn't work during the setup wizard, which is why you finish it first.

In the console, the device's Details View shows whether it enrolled in Work Managed mode.

Lock the device with Workspace ONE Launcher

Workspace ONE Launcher replaces the Android home screen on Work Managed devices (Android 6.0 or later; not on work profiles). It has three main modes: Single App locks the device into one app, Multi App shows a set of allowed apps, and Template builds a custom layout.

1. Go to Resources › Profiles & Baselines › Profiles › Add › Add Profile › Android.
2. On the Launcher payload, select Add and choose a mode.
3. Set the administrative passcode, which IT uses to leave the lockdown.
4. Add the apps on the Apps tab, save and assign the profile.

Launcher installs automatically when the profile reaches a fully managed device. After 10 wrong passcodes, the exit option disappears until a restart. For lock task kiosks, Omnissa recommends a Restrictions profile with Allow Status Bar and Allow Keyguard turned off. More in Android kiosk mode for rugged devices.

Configure Zebra devices

• OEMConfig: Omnissa's TechZone describes adding the Zebra OEMConfig app from Managed Google Play and setting it up under Application Configuration on the app's assignment page. Zebra recommends MX 9.1 or later.
• Product provisioning: Devices › Provisioning › Product List View › Add Product bundles apps, files, actions and profiles and installs them in a set order, for example an OS update package.
• LifeGuard updates: for managed Zebra devices on Android 8 or later, from console 24.10, Groups & Settings › All Settings › Devices & Users › Android › Zebra LifeGuard OTA connects Workspace ONE to Zebra's update service; policies are under Devices › Device Updates › Android (Zebra).

For the Zebra tools themselves, see Zebra StageNow and OEMConfig.

Configure Honeywell, Datalogic and Newland devices

• Honeywell EDA52: Honeywell's 2019 OEMConfig solution brief says its first release was tested with VMware Workspace ONE; the EMM gets the OEMConfig app from Google Play. Honeywell's Play listing for UEMConnect ScanPal names the EDA52 (Android 11). Omnissa also lists Honeywell Enterprise Provisioner for AOSP/closed-network enrollment.
• Datalogic Memor K20/K25: the user manual lists Omnissa Workspace One among supported UEMs. Datalogic OEMConfig runs on Android 8.1 and later and is configured only from the EMM console.
• Newland MT93: Newland lists the MT93 Pro Angled Shooter with Android 13, GMS and Android Enterprise Recommended, so the standard methods above should apply. Newland's pages describe its own free Ndevor MDM and don't mention Workspace ONE.

The makers' own staging tools are compared in Honeywell, Datalogic and Newland provisioning tools.

Common problems

• "Device Managed by Admin" and the device resets: it is registered for zero-touch but was enrolled another way.
• StageNow enrollment fails: check that there is no Google account on the device, Intelligent Hub 8.2 or later is uploaded, and the console uses Custom DPC.
• afw#hub enrollment fails: Omnissa supports it only with Custom DPC on Android 8.0 or later.
• Launcher exit option gone: too many wrong passcodes. Restart the device.