VMware Workspace ONE integration for mobile app management

Integrating VMware Workspace ONE for Mobile App Management

Workspace ONE (formerly AirWatch)—VMware EMM platform unifying MDM, MAM, Identity, Zero Trust Access. Differs from Intune with deeper Android MDM capabilities and historically strong Rugged device support (Zebra, Honeywell). For mobile app, integration built on Workspace ONE SDK—Intune MAM SDK analog with different APIs and lifecycle.

Workspace ONE SDK: Architecture

SDK consists of components:

• AWSDKCore — base SDK, policy handling, auth via Workspace ONE Intelligent Hub.
• AWContentLocker — secure file storage.
• AWNetworkKit — managed networking via Workspace ONE Tunnel (per-app VPN).
• AWDataLoss — clipboard, file sharing, screenshot interception.

On iOS via CocoaPods or SPM:

pod 'AWSDK', '~> 25.0'

On Android via Maven:

implementation 'com.vmware.ws1.android:airwatchsdk:25.0.0'

Initialization and Enrollment on iOS

Workspace ONE SDK requires Workspace ONE Intelligent Hub on device. Hub acts as broker between app SDK and WS1 server. Without Hub, SDK won't get policies.

import AWSDK

class AppDelegate: UIResponder, UIApplicationDelegate {

    func application(_ application: UIApplication,
                     didFinishLaunchingWithOptions options: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {

        AWController.clientInstance().start { error in
            if let error = error {
                print("WS1 SDK error: \(error.localizedDescription)")
            } else {
                self.applyManagedConfiguration()
            }
        }
        return true
    }

    private func applyManagedConfiguration() {
        let profile = AWController.clientInstance().sdkProfile()
        let serverURL = profile?.customPayloadProfile?.payload?["BackendURL"] as? String
        AppConfig.shared.backendURL = serverURL ?? AppConfig.defaultBackendURL
    }
}

AWController.clientInstance().start is asynchronous. App shows splash while SDK initializes and gets policies. If device not registered in WS1, Hub launches enrollment flow.

Custom Payload: Configuration Delivery

Workspace ONE sends config via Custom Payload in SDK Profile—Managed App Configuration analog, managed via WS1 Console:

let sdkProfile = AWController.clientInstance().sdkProfile()
guard let customPayload = sdkProfile?.customPayloadProfile?.payload else { return }

let backendURL = customPayload["BackendURL"] as? String
let featureFlags = customPayload["FeatureFlags"] as? [String: Bool]
let sessionTimeout = customPayload["SessionTimeoutMinutes"] as? Int ?? 30

In WS1 Console Custom Payload set in XML/JSON in Apps → SDK Profiles → Custom Settings. Changes apply on device at next checkin (usually 4 hours or on app foreground transition).

Per-app Tunnel: Managed Network Traffic

Workspace ONE Tunnel—per-app VPN without MDM profile registration (for MAM-only scenarios). Specific app traffic tunneled through corporate gateway.

To enable Tunnel in app—add AWNetworkKit and configure URL sessions:

import AWNetwork

// Replace standard URLSession with Tunnel-aware
let tunnelConfig = URLSessionConfiguration.default
AWNetworkKit.shared.configureTunnel(for: tunnelConfig)
let session = URLSession(configuration: tunnelConfig)

Tunnel works transparently—app makes regular URLSession requests, SDK redirects through VPN. No URLRequest changes or headers needed.

Comparison with Intune

For organizations with Zebra or Honeywell Android fleet—Workspace ONE preferable due to native OEMConfig and Staging profile support.

DLP Policies Handling

let dlpPolicy = AWController.clientInstance().sdkProfile()?.dataLossPreventionProfile

if dlpPolicy?.copyPasteOut == false {
    // Block copy to other apps
    UIPasteboard.general.items = []
}

if dlpPolicy?.enableScreenCapture == false {
    // Show blank screen on capture
    NotificationCenter.default.addObserver(
        forName: UIScreen.capturedDidChangeNotification,
        object: nil,
        queue: .main
    ) { _ in
        self.sensitiveContentView.alpha = UIScreen.main.isCaptured ? 0 : 1
    }
}

Implementation Stages

Configure WS1 UEM Console → create SDK Profile with Custom Payload → add AWSDK to app → implement enrollment lifecycle → Custom Payload mapping → Tunnel setup (if needed) → DLP policies → test on managed devices → rollout.

Timeline: basic SDK integration with Custom Payload—3–4 weeks. Full project with Tunnel, DLP, policies—6–10 weeks. Cost is calculated individually.