Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Upcoming application inventory changes for end-user privacy (74792)

Last Updated: 7/10/2020Categories: InformationalTotal Views: 3918Language:
Chinese (Simplified)JapaneseEnglish

2 like this article

Subscribe to get an email
newsletter with new updates

2 people found this helpful Please provide article feedback:

Purpose

As part of VMware’s initiative to put the privacy of users and their data first, there will be a change made regarding the collection of user’s personal apps on devices of all platforms.

Cause

Applications that are not deployed from Workspace ONE UEM are considered ‘personal’ applications. That is, these apps are installed by end-users themselves from platform specific app stores or from the web. Workspace ONE UEM allows 3 modes of configuration for your end-user’s personal app information:

Collect and display: When you chose the option to ‘collect and display’ your end-user’s personal app information (the name, version, identifier and total size) is collected and displayed on the UEM console. All corporate dedicated and corporate shared devices have this option enabled by default. Having the personal app information from corporate devices allows you to configure and act them through compliance rules, integration with app scanning vendors, enforcing single app mode and taking over management.

Collect but do not display: In this state Workspace ONE UEM collects and saves personal app information there by allowing you to utilize all the policies similar to the above option however the personal app list of your end-users is not displayed to you or your fellow administrators.

Do not collect: For ensuring the privacy of your end-users the behavior of ‘Do not collect’ is being molded to its ideal expectation in the upcoming release of Workspace ONE UEM console. See the following ‘Current Status’ and ‘New Behavior’ sections for details.

Resolution

Current Status

In the Workspace ONE UEM console today, admins have the option to toggle the privacy settings to a value of “Do Not Collect”. Currently, this means that UEM would collect the personal app information, process it to evaluate any policies (like compliance, single app mode etc.) configured on this information and then discard it. As a result, even though the information is marked as private, actions would be taken on end-user devices based on that information. This does not honor your end-user’s privacy.
Employee owned devices and devices of ‘undefined’ ownership type are currently defaulted to ‘do not collect’ personal app information.

New Behavior

In upcoming release of Workspace ONE UEM, the system will no longer collect personal app information from devices when privacy config is set to ‘do not collect’. That is, your end-user’s personal application information will not be transmitted from their devices. This change would have the below described affects in case you have policies configured to act on this information.

Note: For Mac devices, due to OS limitations, Workspace ONE UEM will collect the personal application information and discard the results after processing them if the admin sets the privacy config to 'Do not collect'. Hence the below described impacts are not applicable to MacOS devices.

Workspace ONE UEM Console Version Impacted

Tentative target 1910 with Agent versions:

Android Hub 19.08 or higher

Windows Agent: 1811 or higher

iOS: No agent dependency

Impact

As part of this change, there are some feature caveats admins should be aware of that could be affected. These areas are ones where obtaining the full application list is required to provide the complete experience of the feature.

Organizations that currently or plan to set their privacy settings to ‘do not collect’ should review the list of areas below to evaluate their impact:

Application List Compliance

Issue:

The compliance policy for application list checks to ensure a device has the appropriate applications (denied, allowed, or required). If the system does not query for application list, it will be unable to check for these applications. As a result, devices that contain certain denied applications will NOT be marked as ‘non-compliant’ or similarly devices that do contain certain ‘required’ (personal) applications will be marked as ‘non-compliant’.

Resolution:

Be sure that compliance actions are either taken only on

devices that can have their personal app list collected

applications that are managed and entitled to devices

Single App Mode (iOS only)

Issue:

The single app mode profile payload allows admins to lock supervised devices into specified app bundle IDs. However, if a single app mode profile is sent without the targeted app already installed, the device will be locked into “guided access mode” making the device unusable until MDM removes the profile. In order to avoid this state, UEM queries for the App List prior to installing the profile to ensure the device is installed. However, this is not possible if the privacy setting to “Do Not Collect” personal apps is enabled.

Resolution:

Be sure that single app mode profile is assigned to

devices that can have their personal app list collected

applications that are managed and entitled to devices

Make Apps MDM Managed (iOS only)

Issue:

Applications that assigned to devices with the option to take over management but only on-demand of the end-user would happen only upon end-user trigger to re-install the app from Workspace ONE. The current ability (introduced in 1905) automatically taking over management of on-demand applications will no longer function for devices with privacy configuration.

Resolution:

Be sure that devices that can have their personal app list queried are part of the app assignment policy with the configuration to take over management.

App Scan

Issue:

App scans to third party vendors like Veracode require that UEM provide the list of apps on user’s devices to be scanned and report on any risks or vulnerabilities. If the UEM system does not query for Installed App List Sample, then not all apps will be scanned.

Resolution:

Be sure that devices can have their personal app list queried if your organization requires app scans to take place.

Call to Action

If you have above described use cases to take actions on your end-user’s personal applications list, check the personal app privacy configuration for the concerned device ownership type at all OGs.

Ensure that the config is NOT set to ‘Do not collect’. If you want to ensure privacy of your end-users while having the ability to detect any malicious applications, set the privacy configuration to ‘Collect but do not display’

Or ensure that your end-user devices have the entitlements to receive the applications, that you intend to take actions on, from Workspace ONE UEM.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Workspace ONE

Related Versions:

Take Our Survey

Support Assistant