Workspace ONE Overview and Reference Guide · Title: Workspace ONE Overview and Reference Guide Author: Workspace ONE UEM Created Date: 9/20/2018 10:16:32 AM
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
VMware Workspace ONE Overview andDocumentation Reference Guide
VMware is a registered trademark or trademark of VMware, Inc. in the United States and other jurisdictions. All othermarks and names mentioned hereinmay be trademarks of theirrespective companies.
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 1:Introduction to the VMware WorkspaceONE Overview and Reference GuideVMwareWorkspace™ONE™ deploys and manages resources to a single digital workspace on iOS, Android, macOS, andWindows 10 devices. Services are built on the integration of VMwareWorkspace ONE™UEM (Unified EndpointManagement), VMware Identity Manager™, and VMware Horizon®.
Review a high-level explanation ofWorkspace ONE with descriptions of its integrated systems and the use cases itcurrently supports.
Scope of This DocumentationTheWorkspace ONE platform offers many capabilities. However, this depth has lent to the creation of content not onlyon technical documentation sites, but also on technical marketing sites, and on internal and external professionalsupport sites.
This overview and reference guide is an effort to consolidate documentation and to capture the knowledge sourced inthe field. It lists the documentation available to install the platform and to configure capabilities. It also offers resourcesfound on technical marketing sites and professional support sites.
Workspace ONE Component DescriptionWorkspace ONE is a set of integrated systems that includes Workspace ONE UEM (unified end-point management),VMware Identity Manager, and VMware Horizon.
l VMware Identity Manager services provide the identity-related components, including authentication for users whouse single sign-on to access their resources. You create a set of policies that relate to networking and authenticationto control access to these resources.
l Workspace ONE UEM services, formerly AirWatch, provide device enrollment, application distribution, andcompliance checking tools to ensure that remote access devices meet corporate security standards. Users fromenrolled devices can log in to their enabled applications securely without entering multiple passwords.
4
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
l VMware Horizon services provide remote desktops and applications in the data center, and deliver these desktopsand applications to employees as managed services. End users gain a familiar, personalized environment that theycan access from any number of devices anywhere throughout the enterprise or from home. Administrators gaincentralized control, efficiency, and security by having desktop data in the data center.
Supported Use CasesWorkspace ONE offers solutions for the listed use cases.
l App Access and Management
l Unified Endpoint Management
l Identity Integration
l Enterprise Productivity
About VMware Content SitesThis documentation cites content from the listed resources. Some sites require registration.
Chapter 1: Introduction to the VMware Workspace ONE Overview and Reference Guide
5
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Note: This documentation links to content outside of https://docs.vmware.com/. Content from some sites aresourced from the field and are not fully vetted by research and development. Content might be aged or out-of-datefrom the latest released products and solutions.
l VMware Docs - https://docs.vmware.com/
l VMware Code - https://code.vmware.com
l VMware DigitalWorkspace Tech Zone - https://techzone.vmware.com/
l VMware EUC Blog - https://blogs.vmware.com/euc/
l VMware Technology Network - https://communities.vmware.com/welcome
l VMware TestDrive - https://portal.vmtestdrive.com/
Chapter 1: Introduction to the VMware Workspace ONE Overview and Reference Guide
6
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 2:Workspace ONE InstallationWorkspace ONE is built on the endpoint and identity management infrastructures ofWorkspace ONE UEM and VMwareIdentity Manager. It can also integrate with VMware Horizon to offer robust features for the digital workspace.
To install and configureWorkspace ONE, use an instance of VMware Identity Manager and Workspace ONE UEM.Configure and deploy policies in these two systems to theWorkspace ONE app on devices.
If you already use virtual desktops and apps, integrate VMware Horizon 7with VMware Identity Manager to leveragethese virtual resources.
Components for InstallationTheWorkspace ONE platform uses connectors to integrate components. These systems communicate through theconnectors, and this enables admins to send policies and configurations through their respective consoles to theWorkspace ONE app on devices.
l VMware Identity Manager - Offers user directories, access policies, web apps, and authentication methods, tocontrol user access to resources.
l Workspace ONE UEM - Uses device, app, content, and email management to control the endpoint access toresources.
l VMware Horizon - Runs remote desktops and applications in the data center, and delivers these virtual desktopsand applications to employees as a managed service.
l VMware AirWatch Cloud Connector - This component is the unified connector for theWorkspace ONE platform. Ithas two components: AirWatch Cloud Connector (ACC) and the VMware Identity Manager Connector.
7
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 3:App Access and ManagementWorkspace ONE enables app access and management through the deployment of web and virtual apps with a unifiedapp catalog, management of devices with direct enrollment and virtual desktops, and one-touch access to theseresources through mobile SSO for Android and iOS.
Direct EnrollmentDirect enrollment requires devices to enroll with Workspace ONE UEM before they can access app resources inWorkspace ONE. This requirement enrolls devices as managed access and there are benefits to this process.
l Offers a convenient way for users to enroll with Workspace ONE with less setup on devices.
l Makes resources immediately accessible to managed devices.
Note: If you do not assign managed access to devices, they are enrolled in Workspace ONE UEM as unmanaged.Unmanaged devices have access to resources configured as open access.
Virtual DesktopsVirtual desktops enable users from any trusted connection to access managed virtual apps located in the data center.Create desktop pools that include thousands of virtual desktops with Horizon 7 and deploy them on virtual machinesand physical machines. Use a master image to generate a pool of virtual desktops. Users access app resources in the datacenter from these virtual pools.
Unified App CatalogOne of the roles of theWorkspace ONE app is to be a unified app catalog. Deploy it to iOS, Android (legacy andEnterprise), macOS, and Windows 10 devices. Configure apps in Workspace ONE UEM as open or managed access.
l Managed Access - Device users access resources by granting admins permissions on their devices (installs amanagement profile on the device).
11
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
l Open Access - Device users access resources without granting admins permissions on their devices. The app isavailable to devices no matter their managed status.
Native AppsDeploy native apps through the unified app catalog fromWorkspace ONE UEM. Native apps include internally developedapps, free and paid public apps, and purchased apps from Apple's Volume Purchase Program (VPP). Most native appscan deploy as managed or open access to meet device ownership models.
Self Service Access to Non-Native AppsUsers can select virtual and web (or SaaS) apps through the catalog depending on their needs. If the app is available, theydo not have to requisition it. These types of non-native apps depend on an Internet connection and are not restricted byplatform.
Workspace ONE supports several platform agnostic app types such as virtual apps, Citrix apps, and web apps.
l Virtual Apps - Virtual apps can reside in a data center and you access them from virtual desktops. Virtual apps areadvantageous because they are persistent. If a device fails, the app data still exists in the data center.
If you have existing VMware Horizon and Citrix virtual apps, deploy them to non-virtual devices by integrating theseresources with virtual apps collections in VMware Identity Manager. Then deploy them to devices through theWorkspace ONE catalog.
l SaaS/Web Apps -Web or SaaS apps live in the cloud and users access them by URL. Upload web apps throughVMware Identity Manager and SaaS apps through Workspace ONE UEM.
Chapter 3: App Access and Management
12
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 4:Mobile SSO for App Access andManagementMobile SSO works with apps that are accessed from the cloud. To enable one touch access, use Security AssertionMarkup Language (SAML) to authenticate a user between the identity provider and the service provider in the cloud. Aslong as the device accessing the app has a liveWorkspace ONE app connection, the user does not need to authenticateto use the app.
Workspace ONE offers mobile SSO for iOS and Android resources.
l iOS - Uses a key distribution center (KDC) without the use of a connector or a third-party system. Kerberosauthentication provides users, who are successfully signed in to their domain, access to their Workspace ONE appsportal without additional credential prompts.
l Android - Uses certificate authentication and the VMware Tunnel mobile app. The VMware Tunnel client isconfigured to access the VMware Identity Manager service for authentication. The tunnel client uses the clientcertificate to establish a mutually authenticated SSL session and the VMware Identity Manager service retrieves theclient certificate for authentication.
15
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 5:Unified Endpoint ManagementWorkspace ONE enables you to manage endpoints while still providing privacy by controlling the collection of data. Italso enables the transition from the legacy management ofWindows resources to themodern management ofWindows10.
Device Management and PrivacyManage Android, iOS, macOS, and Windows Desktop devices from a single location in theWorkspace ONE UEM console.Perform functions on a particular set of devices using many different screens in the console. The console offers variousmanagement screens including the Hub, device dashboards, device list views, and device detail views.
Offer end-user privacy while also managing corporate-owned resources with privacy settings in Workspace ONE UEM.Privacy settings provide granular control over what data is collected from users and what collected data is viewable byadmins.
Modern Management for Windows 10Modern Windows management for Windows 10 updates the deployment, control, and management ofWindowsDesktop devices. In the traditional management ofWindows resources, admins need multiple tools to deploy andmanage resources. However, with modern management, admins can work from one location in Workspace ONE.
Modern methods for Windows management update these processes.
l Enrollment - Select from several ways to enroll Windows 10 devices when you integrate your Active Directory (AD)system. Workspace ONE UEM supports enrollment through Azure AD, Out of Box, and Office 365 Apps.
Workspace ONE supports the auto-enrollment of specific Windows Desktop devices purchased from Dell. Auto-enrollment simplifies the enrollment process by automatically enrolling registered devices following the Out-of-Box-Experience.
l Provisioning - Use device profiles to provision and configureWindows Desktop devices to meet business needs.Some useful profiles are listed.
17
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
o Encryption - Secures data on devices by working with the native BitLocker encryption policy.
o Wi-Fi - Connects devices to hidden, encrypted, or password-protected networks.
o VPN - Provide remote and secure access to internal networks.
l App Distribution - DistributeWin32 apps with the software distribution or the peer distribution features. Thesefeatures enable the distribution of large apps along with their complex installation requirements from theWorkspaceONE UEM console.
Software distribution offers management of the app lifecycle that includes add, configure, deploy, track, update andversion, and delete from the console.
Peer distribution offers the samemanagement capabilities but reduces the traffic on communication channels andthe time to download and install.
l Patches and Updates - Use theWindows Updates profile to ensure that Windows 10 devices remain up to date.
Chapter 5: Unified Endpoint Management
18
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 6:Conditional AccessWorkspace ONE offers many conditional access options. Use VMware Identity Manager as your identity provider (IDP) oruse a third-party identity provider to offer the level of authentication that is best for the device, user, and app.
Usemore than onemethod for extra control. For example you can set access policies at the app level, set compliancepolicies at the device level, and use VMware Tunnel to secure the connection between the app and the device.
Access Policies and Compliance PoliciesAccess policies for web (SaaS) apps include rules that specify criteria to meet for access. Criteria include network ranges,device types, authentication methods, and session lengths. Configure these policies in VMware Identity Manager or inWorkspace ONE UEM.
The compliance engine in Workspace ONE UEM secures apps and devices and can prevent compromised resources fromaccessing your network.
VMware TunnelThe VMware Tunnel provides a securemethod for individual apps to access corporate resources. It authenticates andencrypts traffic from individual apps on compliant devices to the back-end system they are trying to reach.
Note: For this method to work, devices must bemanaged by Workspace ONE UEM.
Certificate Based Authentication (CBA)Certificate based authentication (CBA) requires a certificate from the user to establish trust and allow access to apps. Touse this option, ensure that the app supports CBA for the desired platform. Workspace ONE UEM supports numerouscertificate authorities as does VMware Identity Manager.
21
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Chapter 7:Identity Providers for Conditional AccessUse VMware Identity Manager or integrate with third-party identity providers to configure conditional access for yourWorkspace ONE deployment.
VMware Identity Manager as the Identity Provider (IDP)VMware Identity Manager can act as the identity provider service using your existing Active Directory infrastructure.
Third-Party Identity ProvidersIf you already use an identity provider, integrate it with VMware Identity Manager or Workspace ONE UEM and use it tosecure access to resources in Workspace ONE.
You can integrate several IDPs with Workspace ONE that include, but are not limited to the following list.
l Active Directory Federation Service (ADFS)
l AzureAD Identity Services
l Okta
l OneLogin
l PingFederate
24
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018
Identity Provider ContentFind technical documentation and technical notes for integrating third-party identity providers.
Note: This topic references content from https://communities.vmware.com/blogs/identityville. The content on thissite is sourced from the field and not from research and development. It might be aged or out-of-date from the latestreleased products and solutions.
Component Documentation
Identity Providers (General)
Third-Party IdentityProviders
l Configuring a Third-Party Identity Provider Instance to Authenticate Users
Chapter 8:Enterprise ProductivityWorkspace ONE has several solutions to enable business productivity that are built on theWorkspace ONE framework.Workspace ONE can secure email content, manage Internet browsing, help deploy and secure content, and offer asoftware development kit (SDK) to customize internal applications.
Secure EmailWorkspace ONE can help secure data in Outlook and Office 365with data loss prevention (restrictions) policies in theWorkspace ONE UEM console.
Workspace ONE can also enable legacy authentication for Office 365 email clients that use Exchange ActiveSync. Manyorganizations choose this path because Exchange ActiveSync clients do not download the user’s entire mailbox, reducingthe risk of data loss.
Productivity AppsVMware offers several apps for enterprise productivity to deploy through Workspace ONE.
l VMware Boxer - This app provides access to enterprise email, calendar, and contacts across corporate-owneddevices and bring-your-own devices (BYOD). Boxer uses SSL certificates to transmit data and uses AES 256-bitencryption for data and attachments.
l VMware Browser - This app is an alternative to native browsers. It enables admins to control and secure Internetbrowsing behaviors. Browser uses AES 256-bit encryption for streaming, browsing settings, and downloaded files.
l VMware Content Locker - This app enables users to access managed resources deployed to their device. ContentLocker uses SSL certificates to transmit data, AES 256-bit encryption for content deployed in the app, and it usesNSFileProtectionComplete for iOS.
SDK for Android and iOSUse theWorkspace ONE SDK for Android and iOS to customize internal applications, and add unified endpointmanagement features built on theWorkspace ONE framework.
27
VMwareWorkspace ONE OverviewandDocumentation Reference Guide | v.2018.09 | September 2018