How to setup Workspace ONE Launcher to allow Users to access Update Page in Settings
While using Workspace ONE Launcher you sometimes want to restrict access to the Settings , but still keep the Devices up to date with the latest Android Updates. In this Blog I will show the settings required to have the Updates Settings accessible by the user and not opening up the whole Settings. I used the 21.10 Launcher here , while this is supported on Version 3.2+ already.
Adding Action to Launcher Profile
In the Launcher Profile go to “Advanced Customization” and Enable the “Add Custom Device Settings”, then Select “Action” as Type and enter a Name. the Name will be displayed to the Enduser, while the action needs to be the exact Settings page the User should Access. In our case it is “android.settings.SYSTEM_UPDATE_SETTINGS” for the Android Update . Once added Click to “Save” and Publish the Profile.
In Case you do not see it in the Console the Settings (requires UEM 21.11) you can add Custom XML to the Launcher Profile:
<characteristic type="com.airwatch.android.androidwork.launcher" uuid="568bc89d-1df8-4ce9-a041-e5a24acdb7ec">
<parm name="CustomSettings" value="
{
"CustomSettings": [
{
"name": "Update Settings ",
"action": "android.settings.SYSTEM_UPDATE_SETTINGS"
}]
}"/>
</characteristic>This is how it looks on the Device if you open the Settings of Launcher
I have verified this settings on an Samsung S21 and a Nokia 5.4 and they work like a charm.
UX on the Device
On the device the user can see the Update Settings over the Setting s in Launcher, while the rest of the Settings is restricted:
vExpert, blogger and VMware champion. Worked 10 years as a VMware & Microsoft consultant for a partner before joining VMware in 2017.
KJ
Great write up. How did you come upon those android settings? Are you using the android developer site to find that? https://developer.android.com/ Are there other examples?
Patrick Zoeller
I used ADB Tool (Logs) with my Device to find out the exact path to enter for the Android Update
Arian
Hi Patrick
If we want to open the “SIM PIN Settings” in Android, how would you do that with ADB Tool?
I get tons of logs but don’t see any hint how to get that Settings window.
Thanks a lot for your help.
Patrick Zoeller
Hi Arian,
You can use the “Package and Class” and then define the Package Name with “com.android.settings” & Class Name with “com.android.settings.SettingsIccLockSettingsActivity” , this worked for me.
Jose
Hi Patrick,
Is it possible to disable screen lock (slide) on devices remotely?
So that when they reboot the device is unlocked.
Thanks.
Patrick Zoeller
Hi Jose,
So Manually You can do this here : Settings > Security > Screen Lock > None
also with StageNow from Zebra the Setting is called “Screen Lock Type” that can be deployed with Workspace ONE it should work.
best regards
Patrick
Art
This can be done by toggleing off the following settings in a Android restrictions policy: “Allow all keyguard features” and “Allow Keyguard”.
Afroz Khan
Great Article….
Can we do the same for Mobile Data and Hot Spot options ? I am looking for the solution i can allow user to access Mobile Data and Hot Spot toggle in Quick access panel or Launcher setting Page.
Patrick Zoeller
Hi Afroz ,
Tethering works with the following settings :
Package Names com.android.settings
Class Name com.android.settings.TetherSettings
but also there eis a Button to Enable the Settings “Tethering Setting” in the UEM Launcher Profile GUI.
I did not test the Mobile Data , as I do not have a Sim Card in the Device 😉
would be the best to debug on ADB if you are not sure.
best regards Patrick
Shreyas
Hi Patrick,
How do we disable developer settings in the android and IOS devices using workspace1
Patrick Zoeller
For Android you can go to the Restrictions and Disable the Option “Allow USB Debugging” , this will also disable the Developer Options based on my Testings on Android.
Chris
When I set this up it does the check but only ever reports that the device is up to date.
When I go out of the Launcher the device reports an update is available.
Patrick Zoeller
Hi Chris ,
There might be a possibility that it requires some additional Whitelisted Activities depending on you Android OEM Vendor.
Maybe check the “Blocked Applications” so you see if there is anything blocked on your devices.
Roman
Hi Patrick,
great article!
I’m trying to set a specific developer setting (mock location app) via a custom setting paylod. It’s neccessary because the developer options are disabled, yet need to be set by MDM.
Yet, I can’t figure out the correct characteristic type and parm-value (and the correct input for a specific application). Do you have any hints how to do that? I don’t even know if it’s within com.android.settings or a subclass.
It would be very nice to know not just the correct values but also the way to how one can find theese values.
Any help is very much appreciated.
Thanks in advance!
Patrick Zoeller
Hi Roman ,
you can get to the Developer Setting with the following :
com.android.settings.APPLICATION_DEVELOPMENT_SETTINGS
I know there are some Permissions on Apps to use Mocked Lockation, but did not test that so far yet.
Mart
How to set Bluetooth settings in the AE launcher without adding the the com.android.settings?
Patrick Zoeller
Hi Martin, in the Launcher Profile there are Settings called “Device Preference Settings” which has a “Bluetooth Setting” toggle already in the GUI.
Werner
Great article! Well done 🙂
when a pushing a webclip to android launcher profile, we are looking for a way to restrict the access to the URL search bar in the browser. Either hiding the search bar at the top or to block access to it.
What’s the best way to achieve this?
Thanks in advance
Patrick Zoeller
You can use the VMware Web Application , that supports whitelisting or Kiosk Mode, then you can break it down what pages are possible to access. Also on Chrome some App Config for Chrome can help.
So no extra Config required for this on Launcher.
Best regards
Patrick
Sebastian
Great article!!!
Is possible add the phone call app (android) to the launcher? I want only have one app and the phone call as option to the users.
Thanks
Patrick Zoeller
Sure , just use the wished dialer app and add it to the Launcher Home Screen. For example Google has a dialer , but also Samsung has a seperate dialer App.
Torfinn Bøe Henriksen
Is it possible to activate the built in Phone app?
Patrick Zoeller
yes, just add the App to the Home Screen Layout, if it is not visible , you can the App ID.
Tony
The legacy launcher would allow airplane mode to be turned on/off this is not longer an option. What other way could I enable this with out using AIRPLANE_MODE_SETTINGS as this also exposes cell network settings
Patrick Zoeller
Yes, this was there in Legacy, but is not there in Android Enterprise. Direct control of the setting is not possible , but we can guide the User to the Setting.
best regards
Patrick
Patrick Zoeller
You can use android.settings.AIRPLANE_MODE_SETTINGS in the Add Custom Device Settings as Action , there you can enable the “Flight Mode” / Disable it .
Louis
Bonjour Patrick,
Bravo pour cet article. çà m’a ouvert pas mal de piste.
Dans la même lignée que votre réponse, je cherche à n’autoriser que l’accès aux paramètres d’accessibilité dans le launcher. En effet, Google impose désormais à l’utilisateur de redonner les autorisations d’accessibilité aux applications.
Hors mon appli est dans le launcher, et je ne souhaite pas que mes utilisateurs puissent accéder aux paramètres.
2 solutions : soit je trouve un manifeste qui autorise l’accessibilité à cette appli via une commande WS1, soit je leur donne au moins accès coté launcher à ce paramètre. Le profil d’autorisation des applications ne me donne pas cette possibilité hélas.
Je ne suis pas encore en 21.11, alors j’ai suivi votre méthode avec le xml rattaché au profil ( dont je me sers déjà pour d’autres paramètres du launcher). Sauriez vous quel class je peux utiliser pour ces paramètres d’accessibilité?
J’ai fait un essai avec com.android.settings.SettingsAccessibilitySettingsActivity et com.android.settings.Settings$AccessibilitySettingsActivity et çà ne fonctionne pas avec votre modop. Il m’affiche toujours “votre admin vous limite l’accès aux paramètres” quand l’appli essaie d’accéder aux paramètres d’accessibilité. Merci beaucoup pour votre aide.
Patrick Zoeller
Hi Louis,
Sorry my French is not that good , so I will write in English.
Did you try to add com.android.settings.SettingsAccessibilitySettingsActivity as hidden Appliaction (on the Canvas view) , so that the User Can do to that settings. as By Default it might block some settings.
best regards
Patrick
Pascal
Bonjour Louis,
Avez-vous réussi à résoudre le problème?
Car je rencontre la même difficulté et pour le moment je sèche un peu.
Merci
Patrick Zoeller
Hi Pascal , Might be a option to reach out to Louis directly as you both work at the same company as it seems.
Best regards
Patrick
Louis
Thank you very much for your super fast help.
Sorry for the French.
I just added it as a hidden application, but that doesn’t change much. I wonder if it is my xml that would not be good.
Patrick Zoeller
Please share the XML used , the Device Model/ OEM and if you see the buttons and a error come up then check the blocked applications , it should be visible there then.
If not I am happy to try to replicate here , just need to know the config.
Biplob
Hi Patrick,
Great article! I am looking to set the device display brightness to 80% and screen timeout to 30 mins. Would you please help me with the custom settings name and value.
Thanks a lot.
-Biplob
Patrick Zoeller
Hi Biplob,
Fur Zebra Devices , Display Brightness and Timeout can be set via Profile for Zebra Devices or also via StageNow XML (Products).
for other Vendors your have to check their OEM Config App if this is supported or not by them.
best regards
Patrick
Biplob
Hi Patrick,
Thanks a lot for your response.
Actually, we are evaluating other MDM vendors and they have this option of setting brightness and screen timeout within their UI for Samsung and other android devices without any OEM config app. So I was wondering if it can also be done in WS1 with some custom settings.
Regards,
Biplob
Patrick Zoeller
My personal thoughts on this:
I think the Cleanest way is OEM Config , it is integrated in the console, not Updates of API by VMware needed as the full control of the APIs (Device and Software) is within Samsung and seems to be the best option here. Creating a “Samsung Specific” API in the MDM seems to not bee the best case if it works fine with the Smasung Knox Service Plugin with no costs and low/no effort.
best regards
Patrick
Daniel DS
Hi, thank you for this tutorial.
On my side, I’ve got some problem, maybe you can help me:
– for Zebra device (android 11), I can’t figure out the good package and class to open “About Phone” (with useful device info) in Settings
-always for Zebra device, I find how to open StageNow application, but I have strange behaviour, I use com.zebra.devicemanager and class com.zebra.devicemanager.stagenow.main.HomeScreen the app open fine, but when I use scanner to do the main purpose of this app, it just refocus or relaunch the home screen of the app…
Patrick Zoeller
Hi Daniel,
If you want to use some things like Serial or IMEI etc. It might be a better option on adding it as a Widget to the Notification Bar (Currently Custom XML in 22.09 UEM ) so Users Cann access this easy.
Also you can use Sections in Launcher and use the Lookup Value as Headline.
I have a Zebra Device here and there it works to “Scan” Lables. If you have Stage now Still enabled maybe try to disable the Automatic Scanning of Stage Now Codes.
best Regards ,
Patrick
Puneeth
Hi Patrik, it was a great article. While the launcher is installed on the device, it stuck at waiting for profile. Could you please share the profile configuration for single app mode
Patrick Zoeller
Hi Puneeth,
make sure 1 profile is only assigned , disable the “Offline Mode” , If it still does not work , feel free to paste the XML here , I can have a look.
Best regards
Patrick
Michael
How do I reference Android settings that are global? I would like to disable all heads up notifications for 400 devices. I found the attribute but I’m unsure how to reference it since it’s not within an app or package. I believe this is the class that defines that attribute: android.provider.Settings.java.
I found how to do it with adb but I would like to push this configuration from Airwatch.
# adb shell settings put global heads_up_notifications_enabled 1
Also, if I wanted to disable head’s up notifications for a single app rather than globally, how would I accomplish this?
Michael
More details on what I’m trying to do here:
https://stackoverflow.com/questions/74705641/airwatch-workspace-one-disable-heads-up-notifcation-per-app-android
Patrick Zoeller
Hi Michael,
Did you check the Permissions profile and “android.permission.POST_NOTIFICATIONS” set to “Deny Permission”
Best Regards
Patrick
Patrick Zoeller
answered this already a other Comments
leck
Hello Patrick
One question about Auto-rotate, I am also using “android.settings.AUTO_ROTATE_SETTINGS” in launcher – advanced customization.
is there way to allow Quick Panel so that user can simply activate/deactivate auto rotate by one click?
and is there a way to allow Search in settings(not hub settings, cuz i have added com.android.settings)
Patrick Zoeller
Currently this is limited to Flashlight, Wifi, Bluetooth etc. but sounds like a valid Feature request , please follow the Process outlined here https://kb.vmware.com/s/article/2960048
Michael
How do I disable heads up notifications for individual app or globally using custom attributes?
Patrick Zoeller
Hi Michael,
Did you check the Permissions profile and “android.permission.POST_NOTIFICATIONS” set to “Deny Permission”
Best Regards
Patrick
Filippo
Hi, how can I give a user access to WiFi settings? I set up a launcher in multi-app mode and would like the user to change the WiFi independently. What settings can I change?
I have already tried to add in custom settings an XML file:
”
”
I also tried this: ”
Nothing works… Could you help me some how? Maybe I don’t put the flag in some fundamental setting.
Thanks!
Best regards.
Patrick Zoeller
Hi Filippo ,
In the “Device Preference Settings” enable the “Allow Granular Settings” the Setting is Called “Wi-Fi Settings” of Launcher Profile in UEM Console should help here,
Best Regards
Patrick
Filippo
Hi Patrick ! we did exactly what you told us but on the device when we click on the wifi button option in the left menu comes out a popup that says that the administrator has forbidden access to the menu.Any idea on this would be much appreciated ! Filippo
Patrick Zoeller
hi Filippo,
In Launcher there in the Settings a “Application” Section, where you can see the Activities you may need to whitelist additionally in the profile then .
best regards
Patrick
Jason
Hi Filippo! I am looking for the Custom Setting to allow a “reboot” or “restart” to the settings menu. We have our tablets to function as a kiosk and they are in an enclosed stand where you can’t easily access the power button to restart them when needed. I have tried adding “Allow Power Option” under “Utilities on the device” section but the option still not listed. The power option here may just give you the option to hold the button down on the side to reboot. I see the example you have above for “Update Settings” but do you know the option for “Reboot” or “Restart”? Is there a guide that lists what you use to build this xml? Thanks for this great write up!
Patrick Zoeller
Hi Jason,
This sounds like a Feature Request. I am not aware of a “Reboot” button ion Launcher .
Please have a look in the VMware Kb for this :
https://kb.vmware.com/s/article/2960048
best regards
Patrick
Jason
I would also like to mention that “Restart Device” is listed when under admin mode. I don’t want my users having to get into admin mode to restart the device I would rather them just do it from settings.
Patrick Zoeller
Hi Jason,
This sounds like a Feature Request. I am not aware of a “Reboot” button ion Launcher .
Please have a look in the VMware Kb for this :
https://kb.vmware.com/s/article/2960048
best regards
Patrick
Filippo
Hi Patrik, how are you?
I tried following your explanation of the last request I made to you last week but nothing worked.
I created a profile, associated with a smart group, in turn associated with a device.
The device must only have the ability to access 2 apps chosen by me, so I’m using a multi-app kiosk mode that works correctly, but I’d like to give the end user the option of being able to independently change the WiFi settings only, then switch networks at will.
I have a Samsung Galaxy S6 Lite tablet if it helps, updated to the latest Andorid 13.0.
I have already tried, on your suggestion, to enable the WiFi Settings, in Allow Granular Settings, in the Device Preference Settings but as I said it didn’t work.
I’ve already done some more testing including inserting XML Files into the Custom Settings, but it still doesn’t work.
Inside the Launcher I can see the WiFi setting but when I click it it says: The IT administrator has restricted access to Settings.
What can I do?
A thousand thanks!
Best regards!
Patrick Zoeller
hi Filippo,
In Launcher there in the Settings a “Application” Section, where you can see the Activities you may need to whitelist additionally in the profile then .
best regards
Patrick
Mike
Hi Patrik,
Please tell me, is it possible to display information about the amount of free space on the file system in the launcher?
Patrick Zoeller
Hi Mike,
You can point the user to some Settings , but here the list of supported Lookup Values. https://kb.vmware.com/s/article/2960903
As the Value of Free Space is quite dynamic I would rather use Intelligence and if it is below a specific value on Sampling sending out a Notification etc.
best Regards
Patrick
Paul
Hello Patrick
I have been trying to get System Updates to show on a Samsung Galaxy Tab A8 with Launcher 22.10.1.4 but haven’t had much luck with trying ‘android.settings.SYSTEM_UPDATE_SETTINGS’ as you describe. I don’t see anything that relates under blocked applications either. I did download a tool called ‘Package Name Viewer’ and noticed that Software Update seemed to reference Com.wssvncmldm, but even using that as the action didn’t make any difference. Do you have any other suggestions? Did you have to enable anything else within Launcher to allow it to work for you? Such as a Granular setting or utility?
On a side note for those who have had trouble with allowing Wi-Fi options, I have had success with this by using the ‘Allowlist specific Android Activities’ option in launcher and using Package Name ‘com.android.settings’ and Class names com.samsung.android.settings.wifi.WifiPickerActivity & com.android.settings.SubSettings.
Thanks
Patrick Zoeller
Hi Paul,
there might be differences by Vendor and OS Version, check the Blocked Apps if it says that it is blocked. I have tested Flight Mode / Airplane Mode as well working on my Samsung.
best regards
Patrick
Marvin
Hi! I’m having some issues understanding where NFC -settings is located. It works with a bump within an app, but at the same time it says “Administrator has restricted the use of NFC”
Patrick Zoeller
Hi Marvin ,
As it says it is blocked it might be a Restriction as well. So make sure you test this again without Restriction / OEM Config.
If it gets blocked by Launcher it shows up in the “Blocked Applications” , you you know then hat Activity you need to whitelist.
best regards
Patrick
Hatem
Hi Patrick, i search a way to change the key mapping for samsung Tab S7Fe, actually when i push the power button, they launch Bixby, and i want to attribut the power button menu (Power Off, restart)
How can i do with xml please? thank you for your help
Patrick Zoeller
Hi Hatem,
yes, this is possible, just need to add the Samsung Knox Service Plugin to UEM and then configure it in the Workspace ONE UEM GUI like this:
https://docs.samsungknox.com/admin/knox-manage/kbas/kba-692-how-to-set-side-key-to-power-off-device-with-ksp-policy.htm
Also make sure you apply the Premium key for KSP , which is free , but needs to be requested at Samsung.
best Regards
Patrick
Hatem
Patrick, thank you so mutch, you are a great help. Sincerely
Terence
Hi Patrick,
Any idea how I can enable “Overlay permission” within the launcher?
The error I am getting –
OVERLAT PERMISSION
Client require overlay permission to show incoming call from the background.
Thank you in advance and appreciate any sort of direction.
Patrick Zoeller
Hi Terence,
If you use Zebra there is for Example the following possible: https://supportcommunity.zebra.com/s/article/000021297?language=en_US
Most of the Permissions can be granted silently , but this permission needs user Interaction.
Also you can may need to whitelist some actions like android.settings.action.MANAGE_OVERLAY_PERMISSION
Best Regards
Patrick
LondonEye
Hi, this is a great article.
I have an iSafe device and would like to have Buttons that is available in System Settings and Gloves Mode in System Settings > Display to be available in Launcher settings menu.
Can this be done?
Thanks
Patrick Zoeller
Hi,
there are some Display Settings availabe in the GUI of launcher Profiles , check them first , as it works with most devices
Anand
Nice blog..!! I am trying to enable key programmer settings in Launcher using the the package com.zebra.zkeymapper & class name as : com.zebra.zkeymapper.view.ZKeyActivity. It could show the key programmer button when I launch getting notification as “Error launching activity com.zebra.zkeymapper.view.ZKeyActivity”. I am seeing this behavior after upgrading device to Android 11. I am sure it requires some extra permission but unable to find out.
Patrick Zoeller
You might want to test this out to launch it first via ADB to test if the Activity is still valid etc.
I do not have a device here today , but feel free to check that and share the Findings here. so I can have a look next week with my Zebra Device as well.
best Regards
Patrick
Anand
From ADB logs I could see below error while accessing. Seems this activity requires some additional permissions.
*****************************************************************
05-05 13:52:09.326 722 967 D qdgralloc: Imported handle: 0xb400007021de8b30 id: 3109
05-05 13:52:08.425 2681 2755 I chatty : uid=1000(system) android.anim identical 1 line
05-05 13:52:08.441 2681 2755 D WindowManager: updateSystemUiVisibilityLw called
05-05 13:52:09.413 2681 3980 I ActivityTaskManager: START u0 {cmp=com.zebra.zkeymapper/.view.ZKeyActivity (has extras)} from uid 10262
05-05 13:52:09.413 2681 3980 W ActivityTaskManager: Permission Denial: starting Intent { cmp=com.zebra.zkeymapper/.view.ZKeyActivity (has extras) } from ProcessRecord{2d72f3c 18767:com.airwatch.lockdown.launcher/u0a262} (pid=18767, uid=10262) not exported from uid 1000
05-05 13:52:09.418 2681 3981 I system_server: oneway function results will be dropped but finished with status OK and parcel size 4
05-05 13:52:09.421 18767 18767 E AirWatch_AWLockdown: Error while starting native settings from launcher settings,either activity is not present or the activity is not exported
05-05 13:52:09.545 3647 19651 I DPMJ : |REQ:RCVR| DPM creating socket
05-05 13:52:09.576 803 961 W APM::AudioPolicyEngine: getDevicesForStrategy() unknown strategy: -1
05-05 13:52:09.578 2681 3288 I system_server: oneway function results will be dropped but finished with status OK and parcel size 4
**********************************************************
Patrick Zoeller
Can you please try to enable the Native Settings and test again:
<characteristic type="com.airwatch.android.androidwork.launcher" uuid="568bc89d-1df8-4ce9-a041-e5a24acdb7ec"> <parm name="CanLaunchNativeSettings" value="True"/> </characteristic>Marek
Hello Patrick,
I am looking for help with custom settings. I must create access for users to change language and keyboard methods through Launcher. For me, the best will be the same as the updates but enter the language settings with no boundaries.
Can you help me with this?
Thanks
Patrick Zoeller
Hi Marek,
This is in the GUI for the Launcher Profile , just go to „Device Preference Settings „ and enable the „Language Setting“
best regards
Patrick
Marek
I have it enabled, but when I enter the language settings through the launcher and want to continue to other settings, such as keyboards, the launcher stops it, so your administrator won’t allow it.
Do you have some solution for this such as custom XML or something?
Patrick Zoeller
Hi Marek ,
Native Settings can be enabled with the following XML
best regards
Patrick
Filippo
Hi Patrick,
I am contacting you because I have Samsung S6 Lite Tablets connected to the MDM Workspace One in kiosk mode.
The customer would like to use the S-Pen supplied with the Device.
The device is functional but every time the screen is touched with the S-Pen the AirCommand error message is displayed.
How can I make this application work in kiosk mode or how can I disable this error?
I have already tried to insert the application pack in the Miscellaneous section but the error continues to appear.
Thanks in advance and I look forward to your reply.
Best regards.
Philip
Patrick Zoeller
Hi Filippo,
I do not have a S-Pen, hence I can not test it. Do you see in the Launcher a bocked App ID ? If so , please add the App ID to the Hidden apps to resolve this. S-Pen App ID seems to be. com.samsung.android.service.aircommand
If not maybe try to Allow Native Settings with a setting like this
, Check ADB Logs and also the Launcher Logs as there seems to be something blocked
best Regards
Patrick
Filippo
Hi Patrick,
I’m contacting you because I have Samsung Galaxy Tab S6 Lite configured in MDM in multi-app kiosk mode.
The end customer would like to use the S-Pen supplied with the devices but a persistent message is displayed that the Air Command application cannot work and the system administrator should be contacted.
I have already tried to enable the app pack in miscellanous in the launcher configuration by inserting the App both in hidden app and on the main screen of the Devices but it keeps giving me the error.
The S-Pen works correctly, the only problem is that the Air Command App fails to notify the additional features.
I await your reply.
Best regards and have a nice day!
Patrick Zoeller
Hi Filippo,
I do not have a S-Pen, hence I can not test it. Do you see in the Launcher a bocked App ID ? If so , please add the App ID to the Hidden apps to resolve this. S-Pen App ID seems to be. com.samsung.android.service.aircommand
If not maybe try to Allow Native Settings with a setting like this
best Regards
Patrick
Filippo
Good afternoon Patrick,
I purchased new licenses for my customer for Workspace One.
On the MDM portal where can I see how many licenses I have purchased in total and how many I still have available and can I use?
I thank you in advance.
Best regards.
Patrick Zoeller
This is totally far off from the blog post , but if it is shared SaaS the Admin Panel in the Monitor Section is displaying the assigned Products in UEM Console