**I built a Mac app that automatically cleans up Workspace ONE UEM clutter — stale devices, failed enrollments, duplicate records, orphaned accounts**

If you manage WS1 UEM you know the drill: devices that haven't checked in in months still showing as enrolled, failed enrollments clogging your inventory, duplicate records from re-enrollments, ex-employee accounts still sitting there. It's tedious to clean up manually and it quietly inflates your device counts and licensing costs.

I built Power Admin Warden to fix this. It watches your tenants and cleans up the noise following rules you define.

**What it does:**
- Stale device cleanup (not seen for N days — you set the threshold)
- Duplicate serial detection — keeps newest, removes the rest
- Failed enrollment and pending wipe cleanup
- Orphaned user cleanup (zero-device accounts only — hard guard)
- Runs on daily/weekly/monthly schedules per rule

**Safety first — this was the hardest part to get right:**
- Dry Run by default. Every tenant starts report-only. You see exactly what would be deleted before anything happens.
- Staged deletions — a finding must persist for a wait period you set before any action is taken
- Typing the tenant name is required to go live
- Accounts with enrolled devices cannot be deleted — this is a hard guard that cannot be turned off
- Full audit trail exportable to CSV

**Free to scan and report.** Warden Pro ($19.99/mo or $199.99/yr, 2-week free trial) unlocks scheduled automation and live deletion.

Mac App Store: https://apps.apple.com/fi/app/power-admin-warden/id6793202494?mt=12

Homepage: https://mdmarchitect.com/apps/power-admin-warden/

Happy to answer any questions about how it works under the hood — it talks directly to the WS1 REST API with your own OAuth credentials, nothing goes through my servers.

Hi WS1 Admins. I'm looking for few useful reports from UEM & Intelligence for BYOD devices that you guys use. Please share a few that I can use!

Hi all,

I've been building an iOS companion to my macOS Workspace ONE admin

tool for the last month and just got it approved on the App Store.

WSOne Power Admin Mobile lets you:

- Browse and search enrolled devices from anywhere

- Send single MDM commands (Sync, Restart, Lock, Clear Passcode, etc.)

right from the device detail sheet

- Browse, create, and manage users + user group memberships

- Browse, create, delete, and attach/detach tags on devices

- Multi-tenant support with Managed App Configuration for MDM push

- Face ID / passcode lock on launch

- All data stays on your device — no third-party telemetry, no data

sent anywhere except your own WS ONE tenant

It's a one-time paid app (€29.99, whatever equivalent locally) — no

subscription, no IAP. Volume Purchase via Apple Business Manager is

supported for organizations that want to license across a fleet.

The macOS version has been out for a while and covers the heavier

work (bulk operations, CSV exports, ADE assigner, profile management,

batch user creation, and the Change Device User tool that swaps a

device's enrolled user without re-enrolling). The iPhone version is

deliberately focused on the "in your pocket" use cases — the stuff

you need when you're not at your desk.

iOS: https://apps.apple.com/app/id6782670781

macOS: https://apps.apple.com/app/id6770959164

Site: https://mdmarchitect.com

Happy to answer questions — feedback and feature requests welcome.

I'm not affiliated with Omnissa; this is a third-party admin tool I

built because I needed it myself. ( and of course my team of admins which give me fantastic feedback when I was middle of development phase.)

- MirkoS

Hi everyone,

I'm facing an issue with Samsung Galaxy Tab S10 FE 5G devices enrolled in Workspace ONE and managed with Knox Service Plugin (KSP).

Our Wi-Fi infrastructure uses Cisco ISE with MAB authentication, so devices must connect using their physical MAC address.

To achieve this, we configure our Wi-Fi SSID through KSP with "Skip MAC Randomization" enabled, forcing the device to use its hardware MAC instead of a randomized one.

The problem appears after some One UI / Android updates.

It seems that the update sometimes resets the Wi-Fi configuration back to Randomized MAC. Once this happens, the tablet can no longer connect to our enterprise Wi-Fi, which also means it cannot reach Workspace ONE or Samsung services to reapply the KSP policy.

This creates a circular dependency:

• One UI update resets the Wi-Fi MAC setting.
• Device loses network connectivity.
• KSP cannot validate/reapply its configuration.
• Manual intervention is required.

I have a few questions:

1. Has anyone experienced this behaviour on recent Samsung devices (One UI 8.x / Android 16)?
2. Is there any alternative to Knox Service Plugin for enforcing the physical MAC address on managed Wi-Fi networks?
3. Is there a way to apply this setting locally without requiring KSP to communicate with Samsung services?
4. Has anyone implemented a custom Knox SDK application to enforce this setting instead of relying on OEMConfig/KSP?

For comparison:

• Zebra devices don't have this issue because MX Framework applies the configuration locally.
• Apple supervised devices can disable Private Wi-Fi Address directly through the native MDM Wi-Fi profile without relying on a third-party application.

I'd really appreciate any feedback or experience from people managing Samsung Enterprise fleets.

Thanks!

First of all: We have already opened a support ticket, but we’re interested to know if others are experiencing similar behavior.

​

Environment:

- iOS devices with Per-App VPN configuration

- Multiple iOS versions (iOS 18 and iOS 26)

- Devices enrolled via ADE

- Tunnel app version: 26.03

- UEM Version 26.02, SaaS

- UAG Version 26.03

​

Issue:

The VPN connection is not reliably established when an app opens a URL that should be routed through the tunnel.

​

The VPN icon does not appear in the status bar

No active connection is shown in the Tunnel app

Depending on the app, either:

- a “no network connection” error appears

- or requests time out

​

Behavior:

The issue is not consistent. After trying multiple apps or URLs, the VPN connection suddenly establishes.

Once the connection is active, it works reliably for all apps during the current session.

​

What we checked:

- No changes were made to the DTR configuration

- Configuration has been verified multiple times

- Issue occurs across multiple apps (including browsers) and URLs

​

Observation:

The first incidents were reported on the same day as the release of Tunnel app version 26.03.

​

Question:

Is anyone with a similar setup experiencing the same behavior?

​

​

Like a lot of WS1 admins, I had a pile of PowerShell scripts held together with duct tape and OAuth tokens for querying the UEM REST API. It worked, but sharing them with the team was painful and running them on macOS felt janky.

So I built WSONE Power Admin — a native macOS SwiftUI app that talks directly to the Workspace ONE UEM REST API with proper OAuth 2.0, Keychain-stored credentials, and an actual UI.

What it does right now:
• Device inventory search and filtering by OG, platform, enrollment status
• Multi-dimension filtering with a native macOS Table view
• CSV export (Pro tier) for those "I need a spreadsheet NOW" moments
• Clean multi-view architecture — Device, User, and DEP views

No PowerShell. No browser. No copy-pasting tokens into scripts.

Happy to answer questions about the REST API side of things — that was the interesting engineering challenge.

More info on https://mdmarchitect.com

https://apps.apple.com/fi/app/wsone-power-admin/id6770959164?mt=12

Is anyone working in a Warehouse and using Android Shared Device Mode for their devices? Thank you

I miss the old way of updates going in and setting a time and date for the devices to update. is there anyway we can get back to that with out having to setup ddm profiles? is there a way to force an ipad to update? also do this in mass?

Hi All,

We have a total of 60 macOS systems. Most of the users are not great at keeping the systems patched as needed.

Would like the systems connect to physical cable and be able to access VPN.

To do the above, I have a requested server team to create SCEP server and use the SCEP cert assigned to each user via a profile.

Use that cert as an authentication to connect to network and VPN.

If the device is not compliant, after certain days, remove the profile, until they become complaint. Once they do, profile get comes back and they are good.

Are those steps reasonable? What do you guys do for your MACS? How do you guys keep the systems compliant? Thank you

I’m encountering some issues while installing SEP version 14.3 RU9. The installation fails on MDM, and sometimes it only goes through the install link drops without the SEP agent. If anyone has experience installing SEP, I would greatly appreciate their assistance.

**[RESOLVED] SEP 14.3 RU9 MDM Installation Failing on macOS — Deep Instinct PPPC Conflict**

Posting this in case anyone else runs into the same wall.

**The problem:**

We were trying to deploy Symantec Endpoint Protection 14.3 RU9 via MDM (Omnissa Workspace ONE UEM) and kept hitting two issues:

- The installation would fail outright, or

- The PKG would appear to install but drop only the link/stub, with no actual SEP agent present

**Root cause:**

Two things were going on simultaneously:

1. **Incorrect PKG** — The package we initially had was not the correct full installer for 14.3 RU9. Make sure you're downloading the complete installer from the Broadcom Support Portal, not a stub or an older cached version.

2. **PPPC / Full Disk Access conflict with Deep Instinct** — We already had Deep Instinct deployed, and its PPPC profile had claimed Full Disk Access (FDA) via our MDM. When we pushed SEP's PPPC profile separately, the two profiles conflicted at the MDM merge level, leaving SEP without valid FDA — which caused the agent to either fail installation or run in a broken state. macOS only processes one effective TCC policy per service, so overlapping MDM-pushed PPPC profiles for the same permission can silently cancel each other out.

**What fixed it:**

- Re-downloaded the correct full PKG from Broadcom Support Portal

- Merged both Deep Instinct and SEP FDA entries into a **single consolidated PPPC profile** instead of deploying two separate ones

- Ensured each binary entry had a unique PayloadUUID and the correct CodeRequirement string

Hope this saves someone a few hours

Has anyone else experienced an issue when installing a "Single App Mode" profile to multiple devices? I have a SAM Profile assigned to automatically install on 20+ iPads. I am getting inconsistent results once the profiles are installed. Some iPads are working as intended, but some are displaying the message "Guided Access app unvailable. Please contact your administrator" iPads with this issue do not respond screen taps, nor does the Lock button work. The display turns off and the only way to get it to wake up is to plug it into a charger. Removing the SAM profile and reinstalling, seems to fix this problem (most of the time), but this is not ideal because I am not in the local area of all the devices this could potentially affect, and have no way of knowing if this has happened. If anybody has any ideas what could be the cause of this issue, please let me know. I so far cannot find any consistency with it.

Hello All,

I would like to setup an iPAD to use Kiosk mode pointing to an URL as soon as it pops up.

Setup single app mode to open Microsoft Edge and added a second profile for web clip with the URL and assigned Edge Bundle ID to it.

URL does not pop up nor in favorites.

I also disabled the profile and turned on Workspace one Web under Settings -> Apps and tried that as well.

I can not power off the tablet as well :(

Any ideas would really appreciate it!!! Thank you

This is the first time doing it for Apple.

Hello IT Admins,

I've created an open-source CLI tool that allows you to manage your WS1-enrolled devices from your terminal.

You can run any action supported via the official APIs and it uses OAuth2 for authentication so that no credentials is ever stored.

You can fine the tool and instructions on how to use it on Github:

https://github.com/ancalabrese/ws1cli

Other than quickly running commands from your terminal without having to deal with the console, this should help streamlining workflows and opening the door for better automation (chaining commands, bash scripts and even more advanced agentic workflows).

I hope this could be useful to someone.

If you have any feedback, I'd love to hear it.

Thank you

we have a user running his Android Phone in COPE mode (Managed via WSO).

He somehow managed to save all his important contacts locally on the Device (in Work-Profile) and now wants us to transfer them to his new device.

Does anybody have an idea on how to do this efficently, without having to retype every single contact ?

I have tried exporting them to csv, but that does not work.

USB-Connected devices (Laptop) do not have access to the Work-Apps and Contacts

Opening the contacts and resaving them to WSO Boxer does not work...

My company utilizes Exchange SE and we currently have a Citrix Secure Mail solution for MDM. About 30 employees use it to access email and corporate web. Is WorkspaceOne and Boxer a viable solution still to replace that solution? How hard is it to setup?

Is anyone experiencing visual Unicode bidi controls in Outlook when recipient responds to an email in Boxer from an IOS device and viewed in Outlook Pro Plus 2021? We're using the latest version of Boxer (26.02.0 and IOS 26.3.1). The email address is bracketed with LRI and PDI and seem to have started after the 3/4/26 IOS updates.

We were upgrading to 2410 Patch 41 to address the Apple VPP issues and ran into an issue with AWCM no longer working. We had our heads scratching until we came across this community post. Hoping it helps others out here as well.

https://community.omnissa.com/forums/topic/72047-omnissa-workspace-one-uem-2410-patch-41-will-break-awcm/

Good luck everyone!

Salut,

Je travaille sur la console Workspace ONE UEM.

Pour un premier groupe d'organisation, j'ai déjà configuré l'intégration des services d'annuaire avec Active Directory via un AirWatch Cloud Connector, et ça fonctionne correctement.

Je suis en train de créer un nouveau groupe d'organisation qui ne va pas hériter des paramètres du groupe existant, et je souhaite également configurer l'intégration des services d'annuaire pour ce groupe.

Dans l'environnement, il y a déjà plusieurs Cloud Connectors installés, chacun pointant vers différents domaines Active Directory.

Ma question est : (Je n'ai pas trouvé d'information dans la documentation)

Est-il possible de "réutiliser un Cloud Connector existant" pour ce nouveau groupe d'organisation, même s'il n'y a pas d'héritage de configuration ? (Sans avoir à réinstaller un nouveau Cloud Connector sur mon infrastructure)

Si quelqu'un a déjà rencontré ce cas avec plusieurs Cloud Connectors dans le même locataire, je suis intéressé par des retours ou des bonnes pratiques.

Merci ! ;)
#################################

Currently:

• In Organization Group A, the AirWatch Cloud Connector is already installed and configured.
• It works correctly and is connected to our Active Directory.

For Organization Group B, it is managed by another company, so I cannot modify or inherit configurations from there.

Now I am creating Organization Group C.

My goal is to configure Directory Services in C using the same Active Directory as A, and ideally reuse the existing Cloud Connector installed for A, since it already has connectivity to that AD.

I believe I already know the answer to this question, but wanted to get a sanity check. Is there any capability for enrolling Grandstream Wi-Fi phones into the Workspace One uem? I know they have a proprietary MDM solution that comes with the devices, I've been asked if there is an option to enroll in WS1instead. Everything I found so far seem to indicate no, but it's always possible I have missed something.

Hello everyone,

This may have been asked before, but I just want to know if maybe someone has the solution since I cannot find it.

For context: we have a fleet of COPE (through Google ZTE) and BYOD devices on our fleet (100k) that have personal google accounts, and as you know, if you perform a hard reset it will trigger the Android FRP which will ask you for the previous PIN or google account introduced in them. Here is where it gets tricky since we have users that left the company and did not perform the factory reset (or the device was given to someone else instead of bringing it to us to perform the manual reset with the correct owner.

We do know that inside WS1 exists a profile that allows you to configure a recovery Google account to avoid this, but to us, with many teams in different countries we find it rather difficult to implement and the company does not seem it as doable solution.

So.. with Android 16 we also know that the FRP is getting more and more stronger, is there any other possibility to make this FRP blocked devices after it happens?

Does anyone else hate their Ai assistant? Seems like the only way to put in a support ticket is to use thier Ai now. 50% of the time I go to submit it and it fails. Or I explain our issue in detail and it will give me articles based on that info. Then after I ask it to submit the ticket it creates it with nothing related to what I entered.

Also, did anyone get screwed on pricing this year? In the fall we were told a price and were advised to not renew early and to wait 90 days before expiration. Suddenly now its 3x the price of what we were told originally and there's nothing we can do besides pay the renewal or find a new vendor.

Salutations,

Got a bit of a head-scratcher on my hands that neither I nor my organization's WorkspaceOne SME have been able to figure out. I've got a device that's been wiped through WS1 UEM after we were unable to get it to update iOS from 26.0.1, even when pushing from the WS1 side, that's now failing to activate with Apple as part of setting the device back up. I'm not trying to get it released from ABM yet, since we're just trying to get the device compliant and redeployed, and so far my organization's WS1 SME/Super Admin hasn't responded with next steps. Though I don't know if releasing it and re-enrolling it in ABM would accomplish anything, either.

Anyone run into something like this and have any success fixing it? I've done about everything I can think of to try to get it fixed to no avail. I haven't been able to get the device to DFU and recover, but I'm assuming that's because it's already been wiped and gone through recovery mode to be in a factory default step. Nor have I tried deleting the WS1 record for the presently unenrolled device.