Configure Omnissa Workspace ONE for MAM - iOS

NOTE:

Applies to iOS devices only. For Android devices and Workspace ONE, see Configure Omnissa Workspace ONE for MAM - Android

Purpose

Use this guide to collect the Workspace ONE values needed by Imprivata Mobile Access Management (MAM).

The primary tasks are to:

  • Provide Apple Business Manager organization details to Imprivata.

  • Create or confirm REST API access.

  • Create a dedicated Workspace ONE administrator account for API use.

  • Export the administrator certificate.

  • Create required iOS profile settings.

  • Assign the Imprivata Locker iOS app.

  • Configure the required application configuration key.

  • Document the values that will be entered into MAM.

Security Handling

  • The API key, administrator username, administrator password, certificate file, certificate password, and staging credentials are sensitive.

  • Do not send these values in plain text email. Use your organization-approved secure transfer method or enter them directly during the Imprivata implementation session.

  • Use a dedicated Workspace ONE administrator account for this integration rather than a named personal administrator account.

Before You Begin

  • Sign in to the Workspace ONE admin console with an account that can manage global or target Organization Group settings.

  • Confirm the correct Organization Group for the MAM deployment.

  • Provide the Apple Business Manager Organization ID and Exact Organization Name to Imprivata before attempting to assign the Imprivata Locker custom app.

  • Confirm the Smart Group that should receive the Imprivata Locker app assignment.

  • Define the UnlockPIN value that will be used in the Imprivata Locker application configuration. The value must be an integer between 4 and 8 numeric characters and can be any customer-defined value.

Configure Workspace ONE

Perform the following tasks in the Workspace ONE admin console.

To create the REST API key:

1. In the Workspace ONE admin console, go to Groups & Settings > All Settings.

2. Select System > Advanced > API > REST API.

3. Confirm REST API access is enabled for the target Organization Group.

4. Click Add to create a new API service entry.

5. Enter an easily-identifiable service name, such as Imprivata MAM.

6. Set the account type as appropriate for the environment. Use the organization-approved account type and permissions model.

7. Copy the generated API key and store it securely. This value will be entered in the MAM console.

8. Click Save.

NOTE:

At this point, you should have the REST API key and the REST API URL or host name for your Workspace ONE environment.

To create the dedicated API administrator account:

  1. In the Workspace ONE admin console, go to Accounts > Admins.

  2. Click Add > Add Admin.

  3. Choose Basic for the administrator type.

  4. Enter the dedicated username for the MAM integration. Save this username securely.

  5. Enter and confirm the password. Save the password securely.

  6. Click Next.

  7. Choose the appropriate Organization Group.

  8. Select the organization-approved administrator role.

  9. Click Next through the remaining account details screens, as needed.

Role Guidance

  • Avoid using a personal administrator account.

  • Use the minimum role that supports the required MAM integration functions.

  • Document the selected role and Organization Group for your implementation records.

To enable certificate authentication and export the certificate:

  1. On the administrator setup screen, select Certificate as the message or authentication type where presented.

  2. Create a certificate password. Save this password securely. It will be needed in MAM and to export the certificate.

  3. Click Save, then Continue.

  4. Open the administrator account you just created.

  5. Click Next until the Settings page is displayed.

  6. Enter the certificate password.

  7. Click Export Certificate.

  8. Save the certificate file securely. The certificate file and certificate password will be uploaded or entered in the MAM console.

    NOTE:

    At this point, you should have the API administrator username, API administrator password, certificate file, and certificate password.

NOTE:

Complete this task only if the MAM deployment requires Apple Automated Device Enrollment configuration for staging or multi-user workflows.

If the engagement is only collecting API credentials, skip this section.

To set up Apple Automated Device Enrollment:

  1. Go to Groups & Settings > All Settings.

  2. Select Devices & Users > Apple > Automated Device Enrollment.

  3. Click Add Profile or edit the target enrollment profile, depending on your environment.

  4. Set Authentication to Off, if required for the MAM workflow.

  5. Set Staging Mode to Multi User Device.

  6. Select the Default Staging User. If you select a non-default staging user, save the staging username and password securely for MAM.

  7. Set Require MDM Enrollment to Enabled.

  8. Set Supervision to Enabled.

  9. Set Lock MDM Profile to Enabled.

  10. Set Device Pairing to Enabled.

  11. Set Await Configuration to Disabled.

  12. Set Location Services to Skip.

  13. Set all Setup Assistant items to Skip, unless you have an approved exception.

  14. Click Save.

    NOTE:

    • Changing Automated Device Enrollment settings can affect device provisioning behavior. Confirm these settings before saving changes in production.

    • Automated Device Enrollment setting only apply after a device has been erased. Changing ADE settings will not impact a device that has already progressed through Setup Assistant.

Complete this section for every Workspace ONE environment used with MAM. Create one Apple iOS profile that contains the Notification, Passcode, and Restrictions payloads described below. Keeping these payloads together helps ensure Imprivata Locker notifications and required device restrictions are delivered consistently.

IMPORTANT:

iOS allows only one notifications profile to be delivered to a device. Add Imprivata Locker and any other apps that require notification control to this same notifications payload.

  • Use the organization-approved Organization Group, assignment group, and naming convention.

  • Confirm the profile assignment before saving in production.

  1. In the Workspace ONE admin console, go to Resources > Profiles.

  2. Click Add > Add Profile.

  3. Select Apple iOS as the platform, then click Next.

  4. Add the Notifications payload.

  5. Select Apple iOS as the platform, Imperative as the Management Type, Device as the Context, then click Next.

  6. In Select App, select Imprivata Locker (com.imprivata.b2b.locker).

  7. Configure the Imprivata Locker notification settings:

    Notification Setting Required Value
    Allow Notification Enabled
    Show in Notification Center Disabled
    Show in Lock Screen Disabled
    Allow Badging Disabled
    Allow Sound Disabled
    Allow critical alert notifications Disabled
    Allow CarPlay Disabled
    Alert Type None
    Group Notification Type Group into one group
    Preview Type Never

  1. In the same Apple iOS profile, add the Passcode payload.

  2. Set Require passcode on device to Enabled.

  1. In the same Apple iOS profile, add the Restrictions payload.

  2. Under Device Functionality, verify the required values:

    Restrictions Area Setting Required Value
    Device Functionality Allow auto filling of passwords Enabled
    Device Functionality Force on Wi-Fi Enabled

  3. Under Applications, verify the required value:

    Restrictions Area Setting Required Value
    Applications Enable autofill Disabled

  4. Under Security & Privacy, verify the required values:

    Restrictions Area Setting Required Value
    Security & Privacy Allow USB Restricted Mode Disabled
    Security & Privacy Allow pairing with non-Configurator hosts Enabled

  5. Under OS Updates, verify the required values.

    Restrictions Area Setting Required Value
    OS Updates Delay OS Updates (Days) 90
    OS Updates Allow Rapid Security Response Enabled
    OS Updates Allow Rapid Security Response Removal Enabled

  6. Review the profile summary and confirm the Notification, Passcode, and Restrictions payloads are included in the same Apple iOS profile.

  7. After you confirm the organization-approved assignment and Organization Group, save the profile.

Complete this section for every Workspace ONE environment used with MAM. The Imprivata Locker app must be assigned to the correct Workspace ONE Smart Group and must include the required UnlockPIN application configuration key value pair.

IMPORTANT:

  • The Imprivata Locker custom app must first be assigned to your Apple Business Manager environment by Imprivata.

  • If Imprivata Locker is not visible in Workspace ONE purchased or native apps, confirm that the ABM Organization ID and Exact Organization Name were provided to Imprivata and that purchased apps and assets have been synced.

  • Use the organization-approved Organization Group, Smart Group, assignment name, and app assignment process.

  1. In Workspace ONE, go to Resources > Apps > Native Apps.

  2. Open the Purchased tab, or the location where Apple Business Manager purchased/custom apps are listed for your environment.

  3. Select Imprivata Locker.

  4. Click Save & Assign.

  5. Click Add Assignment.

  6. Enter a descriptive Assignment Name, such as Imprivata Locker, MAM Devices, or another organization-approved naming convention.

  7. Enter an Assignment Description, if required.

  8. Under assignment by Smart Group, select the organization-approved Smart Group that should receive Imprivata Locker.

  9. Set App Delivery Method to Auto.

UnlockPIN AppConfig Requirements

Configuration Key UnlockPIN
Value Type Integer
Configuration Value An integer between 4 and 8 numeric characters
Example

1111 is valid as an example only.

Specify a value that meets your organization's length and integer requirements.
Handling

Store the selected value according to your organization's security process.

Confirm it is entered exactly in the app assignment.

To configure the UnlockPIN key/value pair:

  1. In the same Imprivata Locker assignment, select Application Configuration.

  2. Enable Send Configuration, if it is not already enabled.

  3. Click Add under Configuration Key.

    1. Enter UnlockPIN as the Configuration Key. Use this exact spelling and capitalization.

    2. Enter your UnlockPIN value in Configuration Value.

    3. Set the Value Type to Integer.

    4. Return to Distribution after the Application Configuration section shows the configured value.

  4. Click Create to create the assignment.

  5. Click Save, then Publish.

NOTE:

  • At this point, Imprivata Locker should be assigned to the organization-approved Smart Group with App Delivery Method set to Auto.

  • The assignment should include the UnlockPIN app configuration key, Value Type Integer, and a value between 4 and 8 numeric characters.