Introduction to the AirWatch Workspace

Transcription

1 Introduction to the AirWatch Workspace Overview Prior to the AirWatch Workspace, organizations' BYOD deployments were architecturally similar to their deployments using only corporate-owned devices. AirWatch s flexible compliance engine, Terms of Use, and profiling engine were used to enforce policies differently depending on corporate and personal devices. However, full mobile device management (MDM) was still used to secure the devices. These security capabilities include password protecting and encrypting the entire device, visibility into personal apps for blacklisting, and the elevated right to execute a full device wipe should the administrator have the appropriate permissions. Additionally, BYOD devices have been limited to a pre-approved set of devices due to the fragmented capabilities and overhead of training support teams on a variety of devices. From an end user perspective the experience has been intrusive starting from an OS-generated warning message and going through a lengthy process to encrypt and password protect the device. AirWatch Workspace offers a flexible new approach to BYOD through management by containerization" within the device. The Workspace creates a virtual container where all corporate applications (AarWatch and internal) may be visible inside and outside the Workspace view but are secure through a shared container passcode. Productivity tools are granted to end users as apps in the container and can be managed by the administrator at the app- level rather than the device level. Each app maintains security controls built in to prevent data leakage outside of the app. These apps include AirWatch Inbox, AirWatch Browser, and third-party integrated apps in the AirWatch App Catalog, and web app shortcuts on intranet sites that require connectivity. Multiple apps interact seamlessly via Single Sign On to avoid multiple authentication prompts. Dual-Persona separation between work and play Separates from a privacy perspective and does not allow AirWatch visibility into personal apps or the ability to wipe any personal items. Passcode/Encryption enforced only within Workspace Sets complex passcodes that do not intrude on personal life; encryption is only enforced locally within the applications. No MDM Required Avoids OS prompts. All devices whether MDM- or Workspace-enrolled can be managed from a single pane of glass with hybrid deployments. In This Guide In this guide, you will learn the steps required to establish a successful AirWatch Workspace deployment. The guide is divided into sections where you will learn about the following processes: Before You Begin Details AirWatch Workspace prerequisites and all aspects of configuration options, including both automatic and configurable settings and actions. AirWatch Workspace Configuration Covers all settings and configuration options affecting applications and access related to AirWatch Workspace. Workspace Device Enrollment Details the simplified process for enrolling Android and ios devices into AirWatch Workspace. 1

2 Using AirWatch Workspace Explains the on-device menus and behaviors for AirWatch Workspace for both Android and ios devices. Managing Workspace Devices Explains AirWatch Workspace-related management commands and information from the AirWatch Admin Console. Appendix A: SDK Profiles, Policies and Settings Compatibility Details all available aspects related to the AirWatch SDK according to Android and ios. 2

3 Before You Begin Overview Before configuring and deploying AirWatch Workspace, you should consider the following prerequisites, requirements, supporting materials, and helpful suggestions. Familiarizing yourself with the information available in this section will help prepare you for deploying AirWatch Workspace. In This Section Supported Devices Lists all device operating systems supported by AirWatch Workspace. Software Requirements Lists software requirements necessary to utilize AirWatch Workspace. Recommended Reading Lists additional guides that may help develop a better understanding of AirWatch Workspace. Automatic Features Profiles all features, settings and remote actions that are automatically enabled with AirWatch Workspace. Configurable Features Profiles all features, settings and remote actions that can be optionally enabled with AirWatch Workspace. Supported Devices AirWatch Workspace supports Android Gingerbread 2.3 and higher and ios 5.0 and higher. Software Requirements AirWatch Workspace requires AirWatch Admin Console versions 6.5 and higher. App Catalog Requirement The AirWatch App Catalog must be enabled for ios devices for the AirWatch Workspace to function properly. Recommended Reading This guide touches on aspects of mobile application management (MAM) and BYOD deployments. For an extensive background on these topics, please refer to the following guides: Mobile Application Management (MAM) Guide 3

4 BYOD Guide Automatic Features Automatic features require no additional setup or configuration and work as soon as you download and start using the AirWatch Workspace app. Feature Secure Description Encryption Apps All corporate data within the Workspace is secured with FIPS encryption. Encryption is supported at an application level only; all data within the app is encrypted, but full device encryption or SD card encryption cannot be enforced. This is because enterprise data is contained only AirWatch apps. These apps do not allow enterprise data to be exported outside of the Workspace. App Tracking AirWatch Workspace only tracks enterprise apps that are installed. App Security Application security and compliance is enforced for Workspace-enabled apps. Asset Tracking Asset Tracking Location Support Only device platform, model and OS are tracked. Location data is not tracked. Notifications Push notifications from the AirWatch Admin Console to the Workspace. Configurable Features Configurable features can be controlled via Settings and Policies in the AirWatch Admin Console. 4

5 Feature Secure Passcode Policy Compromised Detection Clear SSO Passcode SSO Passcode Lock Enterprise Wipe Configure Terms of Use (TOU) AirWatch Inbox Wi-Fi Apps Description Containerized AirWatch apps within AirWatch Workspace leverage Single Sign On (SSO) to share the same SSO Passcode across applications. Configure SSO Passcode complexity in the AirWatch Admin Console. This SSO Passcode is set when the user initially enrolls using their username and password. Compromised device detection is supported to control access to enterprise apps. A compromised device check occurs when an AirWatch is launched. If the app detects that a device is compromised, the app wipes its data and blocks access. Clears the current passcode used to sign in to apps and prompts the user to enter a new one. Signs the user out of all active Workspace-enabled apps and requires them to insert their SSO Passcode to access them the next time they launch an app. Performs an enterprise wipe on a Workspace-enabled device, which clears all enterprise data within AirWatch Workspace and revokes all access the next time a user opens an enterprise app. Generate a fully customizable and enforceable Terms of Use policy. configuration through AirWatch Workspace is supported using only the AirWatch Inbox. Workspace integration is currently only available for the Android and ios platforms. Use Wi-Fi to connect devices to corporate networks, even if they are hidden, encrypted, or password protected. Available on Android. (7.1 HF6+) Deploying Apps/App Catalog Internal, public/purchased, and web apps can all be deployed to the AirWatch Workspace. Certain limitations may apply for apps that are not app wrapped or integrated with the AirWatch SDK. 5

6 Feature Branding Single Sign On (SSO) Description Outfit AirWatch Workspace-related menu options, backgrounds, and text format according to your organization's brand and aesthetic. Single sign-on allows a user to access all Workspace-enabled applications with a single SSO Passcode without having to enter login credentials for each app. SSO may also allow access to SharePoint and external file shares. 6

7 AirWatch Workspace Configuration Once you have reviewed the automatic and configurable features of AirWatch Workspace you will want to create your custom settings using the AirWatch Admin Console. Configure AirWatch Workspace settings for Single Sign On (SSO), security, branding and more to custom-tailor your users' experience and organization's requirements. Automatically set SSO sessions to lock AirWatch Workspace after a determined period of inactivity. Disable copy and paste, screenshots, print and more when using Workspace-enabled applications. Additionally, customize the look and feel of your AirWatch Workspace according to your organization's brand and aesthetic. In This Section Setting Application Security Policies Choose various application security policies to protect your Workspaceaccessed applications and date. Passcode Mode View how to set a passcode requirement for AirWatch applications. Single Sign On Review how to allow access to applications with a single authentication session. Integrated Authentication See how to integrate authentication requirements for external resources using the Workspace or the AirWatch Agent. Offline Access Read how to allow access to resources when devices are offline. Compromised Protection View how to enable protecting the network from compromised devices. Network Access Control View how to control access to mobile networks including the control of cellular and Wi-Fi connections. Configuring Applications Learn the differences between each type of app and the available options for AirWatch applications. Setting Application Security Policies and Settings Configure Security Policies to set options for accessing and using AirWatch applications. With SSO, users can move between apps without entering login information at each instance. Define the grace period before requiring passcode re-entry and set the complexity of passcodes to maximize security. Configure Settings to set options for behaviors and customization of applications. Settings And Policies include the following sections: Security Policies Configure Security Policies to set options for accessing and using AirWatch applications. Find these settings in Groups & Settings All Settings Apps Settings and Policies Security Policies. Settings Configure Settings to set options for support tools and visual customization of AirWatch applications. Find these settings in Groups & Settings All Settings Apps Settings and Policies Settings. Profiles 7

8 Use these options to create and apply custom controls to SDK and App Wrapped applications. Most of the settings in the Profiles section mirror the options in Security Policies and Settings, so this guide does not expand upon these settings. Find these settings in Groups & Settings All Settings Apps Settings and Policies Profiles. Review the following information about each option to see if default configurations meet your mobile deployment needs. Passcode Mode The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information about, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Configuring Passcode Mode Choose an option to control access to applications. Passcode Mode, Numeric or Alphanumeric Designates a local passcode requirement for AirWatch applications or wrapped applications that have the default settings profile applied to them. Device users set their passcode on the device at the application level when they first access the application. This option is set in the Passcode settings. Disabled Requires no authentication to access the application. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Complete the following Passcode Mode options: Passcode Mode Set as Numeric, Alphanumeric or Disabled. o Authentication Timeout Set the allowable time for access to applications before disallowing access due to inactivity. If SSO is enabled and the passcode times out, the SSO identity logs out of all AirWatch and configured corporate applications and resources. o Allow Simple Value Set the passcode to allow simple strings. For example, allow strings like 1234 and o Minimum Passcode Length Set the minimum number of characters for the passcode. o Minimum Number Complex Characters (Alphanumeric) Set the minimum number of complex characters for the passcode. For example, allow characters like and #. o Maximum Passcode Age (days) Set the number of days the passcode remains valid before you must change it. o Passcode History Set the number of passcodes the AirWatch Admin Console stores so that users cannot use recent passcodes. o Maximum Number Of Failed Attempts Set the maximum times a user can login with an incorrect passcode before having to authenticate and set a new passcode. 3. Save your settings. 8

9 Single Sign On (SSO) The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Note: For information about Single Sign On for ios 7 using Kerberos authentication, refer to the AirWatch ios Platform Guide. AirWatch's single sign on (SSO) feature allows end users to access all AirWatch apps, with a single SSO Passcode without having to enter login credentials for each application. Using either the AirWatch MDM Agent or the AirWatch Workspace as a "broker application", end users can authenticate once using either their normal credentials or an SSO Passcode and then gain access to other applications so long as the SSO session is active. Enabling Single Sign On Enable SSO as part of the Security Policies that you configure to apply to all AirWatch apps, wrapped apps, and SDKenabled apps using a Default SDK Profile. To enable SSO: 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Set Single Sign On to Enabled to allow end users to access all AirWatch applications and maintain a persistent login. 3. Optionally set Passcode Mode to either Numeric or Alphanumeric to require an SSO Passcode on the device. If you enable SSO but do not enable a Passcode Mode, end users will use their normal credentials (either directory service or AirWatch account) to authenticate, and an SSO Passcode will not exist. Note: Wrapped apps must have a passcode, either numeric or alphanumeric. Without this passcode, wrapped apps do not display true SSO functionality. SSO Session Once an end user authenticates with either the Workspace or the Agent, an SSO session is opened. It lasts so long as the Workspace is running in the background or until the Passcode Timeout value defined in the Passcode Mode settings is exceeded. With an active session, end users can access managed applications without having to enter their SSO Passcode. 9

10 Integrated Authentication The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information about default profiles, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Configuring Integrated Authentication Note: Integrated Authentication works in the AirWatch Browser. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Select Enabled and set the following options: Enable Use Enrollment Credentials to access corporate resources listed in the Allowed Sites field with the SSO credentials. Enter systems in the Allowed Sites field to control access to a specific set of sites and domains. You must complete this setting for Integrated Authentication to work. This setting ensures that AirWatch does not expose credentials to non-trusted resources. 3. Save your settings. SSO and Integrated Authentication On the Security Policies page, you can set Integrated Authentication to Enabled to allow the credentials used for applications to be passed on and used for authenticating into websites, such as wikis. Currently this setting only applies to the AirWatch Browser. Once enabled, you must define a list of allowed sites, which are the only sites that will support Integrated Authentication. Additional requirements for SSO: SSO must be enabled and the user must successfully authenticate within an SSO session. The URL of the requested website must match an entry in your list of allowed sites. The website must use NTLM or basic authentication and return a 401 status code requesting authentication. The AirWatch Workspace can only use the enrollment credentials of the user when attempting to authenticate with a website. If a website requires a domain, for example, ACME\jdoe, to log in, and your end user's enrolled with only a basic username, for example, jdoe, then the authentication will fail. Note: Content repositories use the saved enrollment credentials (which are encrypted and shared with all SSO apps). If the content repository requires a different password, the connecting app prompts the user for the password at the time of accessing the repository. Offline Access The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. 10

11 Configuring Offline Access Select Offline Access to allow access using the SSO identity to applications when the device is offline. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Select Enabled and then choose an acceptable time frame for offline access before the device requires reauthentication to the network and applications in the Maximum Period Allowed Offline field. Devices should return online periodically so the system can check device compliance and security status. 3. Save your settings. Compromised Protection The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information about default versus custom profiles, refer to the "Default or Custom Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Configuring Compromised Protection Enable Compromised Protection so that the AirWatch Admin Console blocks access if the device is compromised. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Select Enabled to block an compromised device from accessing your mobile network. 3. Save your settings. Network Access Control The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Configuring Network Access Control Enable Network Access to allow applications to access the mobile network. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Security Policies. 2. Select Enabled and then complete the following options: Allow Cellular Connection Controls cellular connections by allowing them all the time, allowing connections when the device is not roaming, or never allowing cellular connections. Allow Wi-Fi Connection Allows connections using wi-fi networks always or limits connections by Service Set Identifier (SSID). Enter the SSIDs devices can use to access the wi-fi network in the Allowed SSIDs field. 3. Save your settings. 11

12 Branding The following step-by-step instructions explain how to configure this profile as part of the default settings that apply to all applications. For more information, refer to the "Default Settings for Profiles" section of the AirWatch Mobile Application Management Guide. Configuring Branding Change the look and feel of applications to reflect your company's unique brand by configuring images and colors through the use of Branding settings. 1. Navigate to Groups & Settings All Settings Apps Settings and Policies Settings. 2. Select Enabled for Branding and then complete the following options: Reflect your company colors by choosing the Toolbar, Toolbar Text, Primary,Primary Text, Secondary, and Secondary Text colors from a color palette. Enter in your Organization Name. Upload a custom Background Image. Rebrand the following ios devices: iphone, iphone (Retina), iphone 5 (Retina), ipad, and ipad (Retina). Rebrand Android devices by uploading the following sizes: Small, Medium, Large, and Extra Large. Upload a Company Logo for your Phone, or Tablet in regular or High Resolution. 3. Save your settings. Configuring Applications You can distribute applications to end users automatically once an app is activated in the AirWatch Admin Console or on-demand through an App Catalog. The following notes apply for different types of apps you can publish: AirWatch applications This includes the AirWatch Inbox and AirWatch Browser. Note: For AirWatch Inbox on ios devices, ensure sure the correct Default Scheme has been entered: aw client. In the AirWatch Admin Console, navigate to Apps & Books List View. From the Actions menu, select Edit review this. Note: For ios devices, you must enable the App Catalog for applicable Organization Groups so internal apps can be launched directly from the Workspace. Public/Purchased applications Public apps are only available as on-demand, recommended apps. They are not considered containerized and thus do not support SSO, branding, console commands, or updated badges. They will be available for installation and launching in the Workspace launchpad if a default scheme is included in the application details in the AirWatch Admin Console. Otherwise, the app will be available in the App Catalog if a default scheme is not included in the application details. Web applications Deploy Web Clip profiles to push web apps that display as apps in the AirWatch Workspace. When launched, these apps open in the AirWatch Browser. Only web clips that have Show in the App Catalog checkbox checked will appear in the Workspace. to 12

13 Note: For more information on managing apps with the App Catalog, please see the AirWatch Mobile Application Management Guide. 13

14 Workspace Device Enrollment Overview Enroll devices into Workspace to utilize containerized activity. In this section, we will cover how to enroll devices intoairwatch Workspace. Enrolling Devices Enroll devices into Workspace by obtaining the AirWatch Workspace application from the respective app store and providing information used to assign your device to corporate apps and content. To enroll a device, a user simply has to: 1. Confirm that the AirWatch Agent is not already loaded on the device. If the Agent is installed and you try to install the AirWatch Workspace, then you will receive a message indicating you must first unenroll from the Agent before you can enroll with the Workspace. 2. Open your device's app store and search for "AirWatch Workspace." 3. Download the AirWatch Workspace application. 4. Launch the downloaded application from the app menu. 5. Select whether to Enroll with your work or Enroll with your Group ID. Enroll with Enter your corporate address to begin enrollment. If autodiscovery is not configured, then enter your username and password. Enroll with Group ID Enter your enrollment URL and Group ID OR scan your enrollment QR Code. 6. Select your device ownership type if needed. 7. If prompted, create and confirm a unique SSO Passcode that will be used to facilitate single sign on to all apps connected via AirWatch Workspace. This prompt only appears if this is enabled in the AirWatch Admin Console. If a Wi-Fi profile was pushed to an Android device, you will be prompted to install it during enrollment. Android devices also require an additional, final prompt to set AirWatch Workspace as the default launcher. The device is now enrolled and authenticated in AirWatch Workspace. From the moment the user confirms their unique SSO Passcode, if applicable, the containers are secured and the device begins checking for AirWatch applications that are available to the device or already present on the device. Note: Android devices require an additional, final prompt to set AirWatch Workspace as the default launcher. 14

15 Using AirWatch Workspace Overview Upon launching AirWatch Workspace, the application automatically checks the device for all Workspace-enabled apps and encrypts the data within them. The user may freely and securely access tied applications with this initial session and copy content from app to app without having to sign into each instance. Once the user is inactive in the Workspaceenabled applications and the timeout session lapses, the user must enter their SSO Passcode before accessing Workspace apps, thus restarting the session. Additionally, since AirWatch Workspace is managing the session length, activity in the other applications continues, allowing the user to pick up activity without interruption. In This Section Using AirWatch Workspace for ios Profiles the Workspace experience, settings and options for ios devices. Using AirWatch Workspace for Android Profiles the Workspace experience, settings and options for Android devices. AirWatch Workspace for ios For ios devices, AirWatch Workspace exists as a centralized launch pad with links to applications installed on the device. Upon first logging into AirWatch Workspace, view all applications available to the user and their device. Launching Applications Internal Applications Any required applications that are not already installed on the device require the user to tap the app icon, which takes the user to the app store to install the application manually. Icons for non-required apps display in the AirWatch Workspace area with a green plus badge, notifying the user that the app is ready for download from the App Catalog. The user simply taps the icon to begin app installation. Public Applications Icons for public applications also show a green plus badge. When this icon is selected, users are taken directly to the app download page in the device's App Store. As updates become available, the app icon shows a red badge alerting the user that the new version is ready. Users can tap the app icon to go to the app store to initiate app installation. Managing On-Device Workspace Settings Select the top-right Workspace Settings icon to view and access: Troubleshoot View network connection status, and user details, or send debug logs to the AirWatch Admin Console. Unenroll Launch the unenrollment process. 15

16 About See the current version of AirWatch Workspace operating on device, AirWatch Admin Console version associated with the device and Privacy Policy. Unenrolling from Workspace using Workspace on the Device To unenroll an ios device from AirWatch Workspace, navigate to Workspace Settings, select Unenroll Device and confirm the prompt. The device is now unenrolled from AirWatch Workspace. AirWatch Workspace for Android For Android devices, AirWatch Workspace exists as a centralized launch pad with links to applications installed on the device. All app data, icons and functionality remains within the Workspace launchpad without duplicating to the device's native launchpad. Upon downloading Workspace and setting the app as the device's default launcher, you first see the main Workspace launchpad, which shows featured applications and Workspace tools. Launching Applications Internal Applications Any required applications that are not already installed on the device install after a user-accepted notification. Icons for non-required apps are placed in the AirWatch Workspace area with a download icon, notifying the user that the app is ready for download from the App Catalog. The user simply taps the icon to begin app installation. Public Applications Icons for public applications also show a download icon, but when the user taps the icon they are taken directly to the app download page in the device's app store. Navigating the Workspace Launch AirWatch apps docked at the bottom of the screen. Access the All Apps screen, where you can view all AirWatch Workspace apps in a sortable list. Tap the top-right logout icon, which ends the Workspace session. Managing On-Device Workspace Settings Select the All Apps icon to access the Workspace Settings menu, where you can use to configure settings for: Set as Default Launcher Set the AirWatch Workspace to serve as the device's default launcher. Passcode Change the passcode for the device or change the timeout value for the SSO Passcode. Switch Options Set whether to display a persistent notification in the Pulldown Menu, which lets you switch between the Workspace and your personal home screen. Also set whether or not to enable 3-finger swiping, which will display the Settings page if you swipe left in the Workspace, your favorite app if you swipe right, or your personal home screen if you swipe down. Troubleshoot Viewing network status information and user details or send debug logs to the AirWatch Admin Console. Select Profiles to see a list of profiles installed on the device. 16

17 Unenroll Unenrolls the device. About View information about the app version, privacy policy, and source licenses. Unenrolling from Workspace using Workspace on the Device To unenroll an Android device from AirWatch Workspace, navigate to Workspace Settings, select Unenroll and confirm the prompt. The device is now unenrolled from AirWatch Workspace. 17

18 Managing Workspace Devices Overview Now that your users are accessing corporate apps via AirWatch Workspace, use the AirWatch Admin Console to manage Workspace-enrolled devices and users alongside all other devices and users in your MDM deployment. Once the user authenticates their device and sets an SSO passcode, the user may move between apps without entering their credentials in each instance and open documents from one Workspace-enabled app to another Workspace-enabled app without fully enrolling their device into MDM. Managing from the Device Dashboard Once AirWatch Workspace is enabled and users begin to enroll their personal devices, the AirWatch Admin Console detects those devices and displays the information on the Device Dashboard. Search for specific devices in your fleet that are Workspace-only and take Workspace-specific actions on those devices. Managing Workspace Devices from the Device Control Panel Review in-depth device information and perform remote actions on individual devices with the Device Control Panel by locating a single device from either the Device Dashboard or searching for the device with the Global Search feature. The Control Panel provides a Device Information Menu with basic device information, including device type and platform. The Control Panel also provides useful administrative actions (top-right of Control Panel) affecting the AirWatch Workspace and not the device itself. Lock SSO End any current app sessions and prompt user to reenter their passcode. o If a user is no longer with the organization or if their device is lost or stolen, take immediate action and manually lock the device. Locking the device will end the session and force the user to reenter the proper credentials. Clear SSO Passcode Clear the current passcode used to sign into apps and prompt the user to enter a new one. o Forgetting a passcode is the most common issue users face, but it is also the easiest to rectify. Use this action to reset a user's passcode and create a new one, allowing a prompt return to productivity. Enterprise Wipe Remove application information and content within Workspace and unenrolls device. o Similar to the Device Lock feature, Enterprise Wipe comes in handy if a device is lost or stolen. More than simply ending an SSO session, enterprise wipe removes all organization-related content, applications and features. Push Profile Send a newly configured or updated profile to the device for access within Workspace. o access is often a user's primary need when it comes to access on-the-go. Use the Push Profile action to send down new credentials or updated credentials to ensure access is never lost. 18

19 Appendix: SDK Profiles, Policies and Settings Compatibility AirWatch Workspace leverages several existing AirWatch apps and features, each of which hosts a variety of available settings and options. Settings and Policies, AirWatch Applications Compatibility Matrix Settings and Policies Option UI Label Workspace AirWatch Browser ios Android ios Android Passcode Mode Passcode Mode Allow Simple Value Minimum Passcode Length Minimum Number Complex Characters Maximum Passcode Age Passcode History Maximum Failed Attempts Passcode Timeout Single Sign On Enable Integrated Authentication Enable x x Use Enrollment Credentials x x Offline Access Enable x x Maximum Period Allowed Offline x x Compromised Protection Enable Data Loss Prevention Enable x x Copy and Paste x x Printing x x x Watermark x x x x Open Documents in Approved Applications x x Allowed Applications x x Network Access Control Enable x x x Cellular Connection x x x x Wi-Fi Connection x x x Allowed SSIDs x x x x Branding Enable Toolbar Color x x Toolbar Text Color x x Primary Color x x 19

20 Primary Text Color Secondary Color x x x Secondary Text Color x x Background Image (iphone) x x x Background Image (iphone High Res) x x x Background Image (ipad) x x x Background Image (ipad High Res) x x x Background Image (iphone 5 High Res) x x x Background Small x x x Background Medium x x x Background Large x x x Background XLarge x x x Company Logo Phone x Company Logo Phone High Res x Company Logo Tablet x Company Logo Tablet High Res x Organization Name x Logging Enable x x x x Logging Level x x x x Send Logs Over Wi-Fi x x x x * This option is supported but is not configured using Settings and Policies. 20