Service – Week 23-2021 Workspace ONE Updates

• Important Releases and KB Updates
  • Announcing Shared SaaS availability of VMware Workspace ONE UEM Console 2105
    • VMware Workspace ONE UEM Console 2105 is available to Shared SaaS customers as of June 9, 2021! Rollouts to Shared SaaS environments will begin next week.
    • The on-premise installer for UEM 2105 will follow in the next ~4 weeks
    • What’s New?
      • CONSOLE
      • Coming Soon – Deploying Android and tvOS profiles is now faster and easier with the new data-driven user interface. 
        We are eager to get the new DDUI feature to you, but we want to make sure to resolve any issues that might affect usability. You can use this feature in the coming weeks as we roll it out. You will notice updates to your user interface when it is available.
        You can configure profiles for Android and tvOS platforms using the new data-driven user interface, which includes new payload layouts, search capabilities, and profile summary. This data-driven model also allows new keys and payloads released by Google and Apple to be added to Workspace ONE for admins to deploy much more rapidly.
      • Maximize your search results with wildcards in the UEM global search.
        You can now use asterisk wildcards in your global searches. For more information, see Global Search.
      • ANDROID
      • Simplify macOS device provisioning with a new post-enrollment onboarding experience. 
        Keep users informed on the device provisioning process after enrollment completes with the new onboarding experience built into Workspace ONE Intelligent Hub. After enrollment is finished, Intelligent Hub will display a new window, tracking all incoming application installs.
      • We now support device-based accounts with Corporate Owned Personally Enabled (COPE) enrollments.
        For scenarios where devices are not associated with a specific user, the enrollment settings have been updated to include device-based enrollments. This is useful for single-user staging when devices are enrolled prior to being given to the end-user. If Device-Based is selected, unique device-based accounts are generated on enrollment rather than re-using an existing managed Google account if the user has already enrolled a previous device. For more information, see Android Device Enrollment.
      • Automatic seeding of Android Manufacturers and Models.
        Android device manufacturers and models are now added to the console automatically upon enrollment or device sync.  The OEM and models can be used for enrollment restrictions, compliance policies, and the newly introduced Android OEM & Model filter in Smart Groups.
      • Are you having trouble accessing Launcher features when your devices are not connected to a network? We’ve got a solution. Designate your Launcher profile as an offline mode profile.
        Offline mode profiles can now be accessed when the device is offline and allows you to continue your work even when you are unable to log in
      • macOS
      • Simplify macOS device provisioning with a new post-enrollment onboarding experience.
        Keep users informed on the device provisioning process after enrollment completes with the new onboarding experience built into Workspace ONE Intelligent Hub. After enrollment is finished, Intelligent Hub will display a new window, tracking all incoming application installs. Administrators can enable and customize the experience in the UEM Console. For more information, see Enable Post Enrollment Onboarding Settings. 
      • Streamline enablement of Intelligent Hub on macOS endpoints.
        The existing seeded Privacy Preferences profile for macOS Intelligent Hub now also includes the Notifications payload and System Extensions payload to automatically enable all Intelligent Hub functionality on endpoints without needing to create the profiles yourself.
      • WINDOWS
      • Keep managed apps on your Windows 10 devices on Enterprise Wipe.
        Accelerate the process of re-enrollment of your Windows 10 device to a different user. For more information, see Windows Desktop Device Management. 
      • Introducing BitLocker To Go Support. 
        Use the Workspace ONE UEM to require the encryption of removable drives on your Windows 10 devices with BitLocker
      • 2105 Resolved Issues
    • Full Release Notes: https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2105/rn/Workspace-ONE-UEM-2105-Release-Notes.html
    • What’s New Video: https://techzone.vmware.com/?share=video3783
    • KB-Announcement: https://kb.vmware.com/s/article/84056?lang=en_US
  • [Article Update] Workspace ONE Intelligent Hub support for new Macs with Apple Silicon “M1” chips (81678)
    • We have recently discovered that the new “M1” Macs may not always have Rosetta 2 installed by default on macOS, especially after a wipe and reinstall. If installing an Intel-only compiled binary like Workspace ONE Intelligent Hub before Rosetta, the app will fail to launch. This is a behavior we did not encounter during early beta cycles as Rosetta was pre-installed. 
    • 6/10 Update – The 21.05 release of Workspace ONE Intelligent Hub is compiled as a Universal app. Rosetta is no longer required to be installed with this version. VMware will no longer publish the Rosetta-required build of Intelligent Hub and Universal build will be the default going forward. See Intelligent Hub Release Notes.
  • ASDK-172651: VMware Workspace ONE Intelligent Hub app version 21.04+ crashes on Android devices (83900)
    • For some Android users, the Hub application will crash on their devices. The crash does not happen for all users, but for affected users Hub will constantly crash.
    • There are mobile apps that have integrated the Workspace ONE Client SDK. The Client SDK collects operational data and sends it to a VMware service via the Hub app. The Hub generates an anonymous identifier for each app by applying a one-way transformation to its package name. Due to a bug in the generation code, the identifier sometimes contains characters that aren’t compatible with Workspace ONE operational data collection. 
    • The crash will only occur when all the following conditions are met:
      • Hub version 21.04 or later is installed on the end user device. 
      • An app that has integrated version 20.8 or later of the Workspace ONE Client SDK is also installed on the same device. 
      • The package name of the app happens to generate an anonymous identifier that includes characters incompatible with operational data collection. 
      • Note: The crash will not occur for all users of the affected Hub versions, only for some users. 
    • The VMware Product team is actively engaged and is working on a resolution.
  • Workaround Instructions for CVE-2021-3449 and CVE-2021-3450 on VMware Unified Access Gateway (84054)
    • The VMware Unified Access Gateway team has investigated OpenSSL 1.1.1 vulnerabilities CVE-2021-3449 and CVE-2021-3450 and have determined that the possibility of exploitation can be removed by upgrading to Unified Access Gateway version 2103.1. Details of these vulnerabilities can be found at the OpenSSL Advisory – OpenSSL Security Advisory [25 March 2021]
    • Product Versions: Unified Access Gateway versions 3.10, 2009, 2009.1, 2012 and 2103 are affected. Versions earlier than 3.10 do not use this OpenSSL version and are therefore not impacted.
    • This issue is already resolved in Unified Access Gateway version 2103.1. It is recommended to deploy version 2103.1.
    • Workaround in KB.
  • Intelligent Hub for Windows App fails to show Login prompt and no start menu icon is created during enrollment (84033)
    • For Workspace ONE Intelligent Hub Windows the enrollment fails during the reassignment phase with no Login Prompt and no start menu item.  Double-clicking the Hub icon from start menu does not do anything.
    • The log files in Applications and Services Logs for Microsoft-Windows-AppXDeployment/Operational and AppXDeploymentServer/Operational show the following error:Windows cannot install package AirWatchLLC.WorkspaceONEIntelligentHub_20.11.3.0_x86__htcwkw4rx2gx4 because this package depends on a framework that could not be found.
      Provide the framework “Microsoft.UI.Xaml.2.4” published by “CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US”,
      with neutral or x86 processor architecture and minimum version 2.42007.9001.0, along with this package to install.
    • Microsoft .Net components that the Hub UI rely upon could be corrupt.  
    • Microsoft.UI.Xaml.2.4 appears as being installed but in fact has not correctly and completely provided the correct libraries to the OS.
    • Contact Microsoft for the offline package of UI.XAML and assistance in manually installing the dependency packages.  Basic procedure and example is provided in the KB.
  • Workspace One UEM database installer fails during upgrade with error. (84038)
    • Workspace One UEM database installer fails during upgrade with error  ‘Procedure sp_verify_job_identifiers’, Line 41 The specified @job_id (xxxx.xxxxx.xxxx.xxx’) does not exist.
    • The previous database upgrade was performed with higher privileges(sysadmin) and the current upgrade is performed with standard privileges (DB_Owner and SQL agent_operator role), due to which the current upgrade is unable to override the changes.
    • Workaround 1 :-Customer has to delete the old SQL agent jobs from the database before re-running the upgrade, the installer will recreate the missing jobs.
    • Workaround 2 : Perform the upgrade with the same privileges as the previous upgrade (Sysadmin).
  • Prompt – ‘User Changed, device was previously checked out by another user’ is shown on devices for Multi-User staging scenario post Workspace ONE UEM console upgrade to 2102 (84025)
    • For environments with Multi-User staging enabled with Check-In/Check-Out (CICO) scenarios, after upgrading the Workspace ONE UEM environment to 2102, the devices that were checked out before upgrade observe a prompt on the iOS hub and other SDK apps. 
    • “User changed: It appears that this device was previously checked out by another user in a different application. To ensure privacy, current application data will be wiped.” 
    • After clicking on dismiss, the apps will reconfigure to the environment. This issue does not occur if the apps check out after the upgrade. 
    • Customers who already upgraded to 21.02, can ask users to check out their devices one more time (after upgrade to 21.02) to avoid seeing prompts after the fix gets applied. If not, the apps will be reconfigured after the fix is applied to a patch of 21.02, 21.05, or 21.07 GA version.
  • End of General Support for AirWatch DataMart (84035)
    • May 2022 will be End of General Support for AirWatch DataMart. Access to AirWatch DataMart will be removed from Workspace ONE UEM in subsequent releases.
    • Customers currently leveraging AirWatch DataMart are encouraged to migrate to Workspace ONE Intelligence prior to the end of general support, which supports the same functionality and more. Details of Workspace ONE Intelligence can be found here.

• Techzone, Blog and Podcast Updates
  • Quick-Start Tutorial for VMware Dynamic Environment Manager
  • Managing Profiles and Policies for Windows Desktops: Dynamic Environment Manager Operational Tutorial
  • Why Use Android Enterprise for Mission-Critical Devices?
  • Three ways VMware App Volumes improves your app management experience
  • VMware Horizon Recognized with the DaaS Growth, Innovation and Leadership Award from Frost & Sullivan
  • Techzone Podcast: CMMC Compliance
  • EUC vExpert Monthly Digest – May 2021

• Industry News, external Blogs and links
  • What’s new in managing Apple devices – WWDC 2021 – Videos – Apple Developer
  • Apple WWDC: Meet My New Friend: Declarative Device Management

• Week 23 Software Updates

• Component: Workspace ONE UEM
• New Release: 21.05
• Changes:
  • Please see the dedicated part above.
• Release Date: 09.06.21
• Release Notes

• Component: Workspace ONE Content for iOS
• New Release: 21.04.1
• Changes:
  • In this release, we’ve made a few updates containing general quality and performance improvements with no new features.
• Release Date: 10.06.21
• Release Notes

• Component: Workspace ONE Intelligent Hub for Windows 10
• New Release: 21.05
• Changes:
  • Improved support for virtual Workspace ONE Intelligent Hub Apps within the Hub Catalog.
  • Updated the Angular Favorites tab and catalog.
  • Enhanced the enterprise wipe feature.
  • Added Bitlocker To Go support (BL2GO).
  • Added the ability to Suspend & Resume BitLocker from the More Actions menu.
  • Added a Post-Enrollment Onboarding (PEO) workflow.
  • Made some Workspace ONE Intelligent Hub UI changes including the menu icon.
  • Added support for App Approvals and Justification Prompts.
• Release Date: 09.06.21
• Release Notes

• Component: Workspace ONE UEM
• New Release: 21.2.0.13
• Changes:
  • Patch Release
• Release Date: 14.06.21
• Release Notes