© 2014 VMware Inc. All rights reserved.

VMware Workspace ONE

Lorenzo Di PalmaVMware EUC Specialist

End-User Computing used to be easier …

… now it’s all about choices:

§ Devices§ Applications§ Architectures§ Ownership§ Mobility … AND it has to add tangible

value to the business!!

The Changing IT Landscape

… everything was locked down, easy to manage …

§ Operating costs are high and rising – so busy farming the old technology, can’t embrace the new

§ Management / security processes configuration-based– discourages diversity and inhibits change

§ We no longer own all the assets– control and relevance is already slipping away

Fundamentally, the Old Ways Just No Longer Work

The transformation of end user computing is inevitable …

… but to what?

Mobile andCloud FIRST

DoingWindows BETTER

TransformationChoices

Traditional End-User Computing

Eg.• Physical PCs• HW refresh• PCLM• Windows XP/7/8• Windows apps• MS Office

Windows Transformed

Eg.• Virtualized desktops• Remoted apps• Device diversity

PCLM and EMM• Windows apps• MS Office

Native Mobility

Eg.• Any device• Any OS• EMM• SaaS and Web apps• MS Office 365

?

• iTunes • Apple ID• App Store• iWork• iCloud

• Gmail Account• Google Play• G Suite• Google Drive

• Microsoft ID• AD/Azure AD• Office 365• Windows Store

Update Service• SCCM

• Salesforce 1• Concur• Workday• Slack• Dropbox• Docusign

Mobile Team Desktop Team LOB

iOS / MAC ANDROID / CHROME WINDOWS SaaS APPS

A Platform Approach Breaks Silos and Delivers a Digital Workspace

Connected Things

(Rugged / IoT)

Identity and Access Management

Unified Catalog Single-Sign On Authentication Access Policy

Digital Workspace Platform

End-User Services Team

iOS / MAC ANDROID / CHROME WINDOWS SaaS APPS

New Approach

Manage and secure apps and content

Device Trust established through enrollment

Access Controlled by Identity Management

Drive a New Approach to Mobile Security and Identity

Old Mindset

Only trust devices where you manage the OS

Device Trust established by the Domain

Access Controlled by Network Management

Challenges Organizations Face with Identity

Protecting apps and data from unauthorized

access is important but authentication and ease

of use needs to be straightforward

Enforce security and compliance

without hampering workers

Employees and their devices are increasingly on the go.

Access control to apps becomes more important

than networks. Device diversity adds to the

complexity

Time and complexity in delivering new apps and services

Real-time visibility, proactive alerting, reporting and

analytics are all required to know what apps are being used, when, and by whom.

This helps manage licensing, SLAs, and maintenance

windows

Gaining visibility into user access.

Who has access to when, and when

Complexity of scale and growth

(Operations, Helpdesk)

A general state of readiness to scale as traffic, users and devices

grow in number across the organization

CONSUMEREXPECTATIONS

DELAYS IN APPDEPLOYMENTS

COMPLIANCENIGHTMARES

OPERATIONSUNDERWATER

7 “Must Haves” for a Cloud / Mobile Identity Management Solution

1Directory Integration2

Policy Management

3

Application Provisioning

4

Analytics / Reporting

5Cross-device Catalog and Launcher

• Be easy to use and reduce complexity

• Increase productivity

• Meet security & compliance requirements

• Automate and streamline onboarding and revocation

• Reduce help desk ticket costs

• Support any type of device and OS

• Support mobile and SaaS apps

AND

THE

SOLU

TIO

N M

UST

6

Single-Sign-on

7

Multi-Factor Authentication

10

Web Apps

ThinApp

Horizon Desktop

Horizon Hosted App

Office 365

Citrix XenApps

App Catalog

Context Aware

Custom Branding

App Access Through Workspace ONENative

mobile apps

Web apps

On-premapps

Virtual apps

OR

In-house mobile apps

Public mobile apps

Unified Workspace with entitled apps

Workspace ONE

Self Service Access - Mobile Single Sign On

Workspace™ ONE™Secure App Token System

SaaS Apps

TRUST

Trust ID Key

Cloud

Mobile SSO - Secure App Token System

• Commonly known as “Cloud KDC”• Provides Single Sign-On (SSO) for iOS SAML enabled apps • No need for Corporate VPN• No need for manually entering credentials• Uses:

• iOS 9 built-in Kerberos functionality

• IDM hosted Kerberos adapter

• IDM hosted KDC

One-Touch mobile SSO

CONFIDENTIAL 14

• Industry’s first one-touch single-sign on (SSO) for public mobile apps

• Device Trust Authentication: the device itself becomes a factor of authentication to anchor an SSO experience.

• The app is only available to that device, and the user must still be able to unlock the device.

• Many people associate touch ID as a form of authentication for SSO, but...

• touch ID only unlocks a device, taking the place of pin code entry, which is always a backup to touch ID.

• Workspace ONE supports pin-code entry or touch ID as another quick assurance that a device is still with its owner.

Workspace ONE: Multi-Factor Authenticationvmware verify

15CONFIDENTIAL

16CONFIDENTIAL

Launch and SSO to non-SAML web apps

Capture, store, and replay password

Chrome, Firefox, IE supported

Training mode for customer admins

New Browser Extension for password vaultingand SSO to Non-Federated Apps

16

DEMO VIDEOhttps://www.youtube.com/watch?v=0lk-nXL16ik&feature=youtu.be

Workspace ONE: Keep Barriers Between Work and Personal

17

Separate work and personal apps

Prevent data flow between work and personal apps

Allow IT to only manage and secure the work apps and data

X

Security Across Key Applications

18

Content Locker

Browser

Boxer

Secure and Integrated Access Across Apps

Open attachments

Browse links

Open downloads

Brow

se lin

ks

Share content

Workspace Services ProfileMore diverse app ecosystem

Better security and configuration capabilities

Requires profile on the device

Privacy concerns in BYOD deployments

2

O/S

MA

M

App Container1

Doesn’t require profile installation

Ideal for BYOD deployments

Limits app ecosystem

Requires proprietary SDK STA

ND

ALO

NE

MA

M

Only approved, authorized apps installed in corporate container

Organizations can detect jailbroken or rooted devices and take compliance action

Separate work and personal apps

Stand Alone MAM vs. O/S MAM

19

NAT

IVE

O/S

MA

MST

AN

D A

LON

E M

AM

Enterprise SecureAdaptive Management: Productivity Without Compromising Privacy

20

Download Secure App

Access All Business Apps

Enhanced Security and Experience

Workspace ONE for All Use Cases

ADAPTIVE MANAGEMENT

iOS• Adaptive Management

– User can see upfront what features they get by enrolling their device– Privacy notice: to enable the user to see exactly what information is collected by AirWatch– Device management using a limited MDM capabilities

• Container Functionality– Support for AirWatch productivity apps without enrollment– Ability to install native public apps from the app store without device management

• Kerberos Based SSO for Native Applications

21

Android• Adaptive Management

– User can see upfront what features they get by enrolling their device.– Privacy notice: to enable the user to see exactly what information is collected by AirWatch.– Device management using Android for Work.

• Container Functionality– Support for AirWatch productivity apps without enrollment.– Ability to install native public apps from the app store without device management.

• Certificate Based SSO (requires agent, tunnel server and client)– Will require agent with version 2 of the app– Requirement for agent will be removed with version 2.1– Requirement for tunnel server will be removed in version 2.1

22

Windows 10• Adaptive Management

– User can see upfront what features they get by enrolling their device– Privacy notice: to enable the user to see exactly what information is collected by AirWatch– Device management using native MDM for Windows

23

Create Compliance Policies for User Groups and Devices

24

App whitelists

App blacklists

Required apps

Current app

version

Assignment criteria

Remediate immediately

Send push notifications

Uninstall apps

Policies Actions

Pervasive Security: Datacenter to Device to App

DataCenter

Multi-layered Defense for the Secure Digital Workspace

25

VirtualDesktopDevice

Per-app micro-VPN

NSX Micro-segmentation

+AirWatch Horizon 7

VMware NSX for AirWatch

26

Device Level VPNFull Network Access

App Level VPNSelect Network Access

Micro Segmentation with NSX

App Level VPNFull Network Access

VMware NSX for AirWatch

CONFIDENTIAL 27

Advanced security between an AirWatch-managed device and

the NSX micro-segmented cloud data center

VMware Workspace ONE – an Identity Management SummaryBuild an App Catalog• Install apps directly onto springboard or access through responsive HTML5 app portal• Auto-Provisioning Workflows

Federate User Identity• SSO with Domain Login• Permits Strong Authentication - Provision and revoke access instantly

One-Touch Authentication• No configuration or login required• Leverage device ownership and unlock to establish authentication

Conditional Access• Managed or Unmanaged devices, Network Scope, Authentication Strength• Set policy levels by app

Secure Data on Device• Encrypt and wipe application data using optional AirWatch Mobility Management• Apply Device-based restrictions (cut/copy/camera/GPS/Open in)

✔ ✗

Identity and Access Management

Unified Catalog Single-Sign On Authentication Access Policy

AirWatch Unified Endpoint Management (UEM)

Management Context

End-User Services Team

iOS / MAC ANDROID / CHROME WINDOWS SaaS APPS

Unified Endpoint Management - One Platform For All Use Cases Open Ecosystem

App ConfigCommunity

Mobile Security Alliance

Authentication and Identity Providers

Connected Things

(Rugged / IoT)

Virtualize

Onboard Devices Quickly And Without IT Hassle

Configure devices to be automatically configured during initial power ON

Corporate Owned Devices

Out of Box EnrollmentEnable users to activate work services on devices through a simple workflow

BYOD

End User Self Service

• Restrictions• Device layout• Settings access• Notifications• Location services• Bluetooth• Branding

• Internal and public apps • Volume purchased apps• Enterprise app catalog• Single sign-on• DLP and security policies• App tunneling

• Corporate email• Calendar and contacts• Wi-Fi • VPN• Content repositories• Intranet sites

Configure Devices with Apps and Resources

Devices Apps Systems

Manage Industrial Devices in Modern Framework

Industrial• Device staging• Provisioning framework• Multi app launcher• Remote management• Developer tools

Gain Visibility Over Peripherals

Centrally Deploy

• Standardize onboarding

Closely Monitor

• Asset tracking

• Device pairing

• Usage and life expectancy

Proactively Manage

• Alerts and settings

• Automated reports

Control Device Layout and Manage Apps

App Kiosk• Single or Multiple apps • Custom branding• Layout defined• Restricted settings

Enable Multiple Employees to Share a Single Device

Multiuser • User check-in and out• Custom profile by user• Settings restricted• Custom branding

Secure the Endpoint and Prevent Data Loss

Encryption

Device level encryption

Hardware security

Biometric integration

Passcode

Complexity

Expiration

Device and app

Data

Sharing permissions

Copy / paste

Geofencing

Watermark

Data backups

Wi-Fi

TLS

Siri

Always-on VPN

Whitelist

Blacklist

Tethering

Settings

ConfigurationsCompromised

Jailbroken

Remote wipe

Malware

Gain Real-time Insights and Remotely Support Users

Dynamic and modular dashboards

Detailed and exportable reportsComparative industry analytics

Advanced event and device logging

Integration to BI tools

End user self-service portalRemote management and troubleshooting

Remote commands and notifications

Dynamic Dashboards Based on User Roles

Helpdesk AdminSecurity Officer

App Admin Content & Video Admin

System Admin

EmailAdmin

Multitenant Architecture with Role-based Access Controls

Easy Policy Configurations with Industry Templates

ConfigurationCan Be

Overwhelming…

100s of devices1,000s of configurations

Millions of appsIndustry Templates

Simplify device setup with right configurations, apps and policies based on use cases within your industry

Intelligently Assign Based on Dynamic Groups

Smart Groups

Automatically Configures Dynamic Updates

Salesforce App > Global Sales Team

Conference Room App > Only Android v2.0+

APAC Email Server > All APAC Employees

DevicesPlatform OS and VersionsOwnership Model

UsersExecutivesEngineeringSales

TagsLocationHistory

Integrate and Automate with Robust API Framework

Allow external systems to invoke core product functionality

EnrollmentAuthenticationAdmin Users

ApplicationsContentProducts

TagsDevice Groups

Custom Attribute

Device DetailsDevice Profiles

Email

Smart GroupsUser GroupsNotifications

Third Party Solutions(examples)

Internal Systems

Operations

Services

Proprietary

< extend >

Automated Compliance and Remediation

Set Rules

Define Actions

Perform Escalations

>

>

>

Customizable Experience for Your Users

BrandingConsole | Apps | Self-Service Portal

Globalized Available in 19 Languages

Extend Best-in-Class EMM with Critical PC Management NeedsComprehensive unified endpoint management (UEM) features transforming the way IT manages Windows 10

Self-Service Access & SSO

Co-exist with Systems

Management

Deploy Updates Off the Network

Device HealthAttestation

Win32 AppLifecycle

Management

Instant Push Configuration

for Policies

GPOs On or Off the Domain

Windows Information Protection

Patch Auditing

Granular Updates

Management

5. Client Health & Security

3. OS Patch Management

4. SoftwareDistribution

2. ConfigurationManagement1. MDM for Windows

Asset Tracking

Device and OS Lifecycle Management App Management and Delivery

End-to-end Security Management

App Inventory

BitLocker Encryption

Enterprise App Store

Imageless Provisioning

In-place or custom image

migration

Modern Management

Intelligent Insights and Rules Engine

BIOS Management Delivery

OptimizationAutomatedCompliance

New Windows 10 PC Management Features for Next-Gen PCLM

Deploy

Patch

Configure

Apps

Windows 10 Provisioning Service for Dell devices ensuring instant productivity

Windows Update Analytics & Automation powered by Workspace ONE Intelligence

New use cases for hands free management of Dell BIOS

Peer Distribution of software for scale, infrastructure reduction and speed

© 2017 VMware Inc. All rights reserved. Confidential – Not for Distribution© 2017 VMware Inc. All rights reserved. Confidential – Not for Distribution

Productive User, ITself-service features for peak user and IT experience

Reduced Costssilo-less management at reduced TCO

Improved Securityreal-time compliance on any network

Mitigates risks; drives productivity and cost

savings.

AdminGPO and app migration from ConfigMgr/SCCM to AirWatch

Windows 10 Provisioning Service for Dell DevicesEliminate manual configuration of PCs and drop-ship straight to user

Business

Modern deployment solution

Employees productive day one

IT

Eliminate high touch PC setup

Respond faster to users in need

© 2017 VMware Inc. All rights reserved. Confidential – Not for Distribution

Trusted securityenable hardware and OS level security at boot

Setup at initial boot drop ship PC directly to user; auto configuration upon first booth

Auto configure apps, security settings and system policies over the airFactory End userDistributor System

Integrator(Staging / Kitting)

ITDepartment

Factory End userWith

Win

dow

s 10

Prov

isio

ning

Ser

vice

Cur

rent

Ap

proa

ch

Instant Productivitynew first launch experience with Workspace ONE

47

What are the Issues with the Digital Workspace

48CONFIDENTIAL

Data Overload

Data

ReactiveEvents

Visibility

Siloed Visibility

Processes

Manual Processes

Introducing Workspace ONE Intelligence

49CONFIDENTIAL

Complete Visibility

Proactive Automated Actions

ONE Data Lake

Workspace ONE

Intelligence

Workspace ONE Intelligence

50CONFIDENTIAL

Enables data driven decisions and actions from a single source of truth

Apps

Networks

Sensors

Devices

Workspace ONE

Intelligence

Security

Alerts

Reports

APIs

Dashboards

Is a new set of capabilities that provide deep insights into the entire digital workspace, enable smart EMM planning and offer powerful automation that together increase security, compliance and user experience across the entire environment.

51CONFIDENTIAL

Workspace ONE Intelligence

CONFIDENTIAL

Rules engine to automate

actions

Automation

Visibility into entire environment

Insights

Data to make the right decisions

Planning

Machine learning to predict and

remediate anomalies

Prediction

FUTURE

THANK YOU!!