Lab 3: User and group management

Objective and Tasks

  1. Create a Basic User
  2. Review the User Management Settings
  3. Review User Roles
  4. Add a Custom Administrator Role
  5. Add an Administrator and Assign Roles
  6. Review the Administrator User Management Settings
  7. Log In with a New Admin User and Test Role Permissions
  8. Create an assignment group
  9. Create an Organization Group

Task 1: Create a Basic User

You create a basic user account in the Workspace ONE UEM console. The basic user account is used for enrolling devices in later lab activities.

  1. Open the Workspace ONE UEM administration console.
    1. On the ControlCenter Windows taskbar, click the Google Chrome icon.
    2. From the bookmarks bar, select  Workspace ONE UEM.

You can also enter https://omnissatraining.awmdm.com/Airwatch in the address bar to access the console page.

  1. Log in to Workspace ONE UEM.
    • User name: studentadmin{labid}
    • Password: Pa$$w0rd

  2. In the navigation pane at the top, select Accounts, and then click Users.

  3. From the Add drop-down menu, click Add User.
  4. On the General tab, configure the user information.
OptionAction
UsernameEnter newuser{labid} in the text box.
PasswordEnter Pa$$w0rd in the text box.
Confirm PasswordEnter Pa$$w0rd in the text box.
Full NameEnter New in the First Name text box and enter User in the Last Name text box.
Email AddressEnter [email protected] in the text box.
  1. Click Save.

Leave the Workspace ONE UEM console page open for later labs.

Task 2: Review the User Management Settings

You review the user management capabilities in the Workspace ONE UEM console.

  1. On the Users page, click the studentuser{labid} hyperlink under the General Info column.
  2. Click the More Actions drop-down menu and review the available options.

Task 3: Review User Roles

You review the available user roles.

  1. In the upper-right corner of the console, click the drop-down menu with your administrator name and verify that Student{labid} organization group is selected from the Organization Group drop-down menu.

  2. In the navigation pane at the top, select Accounts. Under Users click User Roles.
  3. Review the available roles.
    • Through their OG settings, all new or imported users can be assigned to have access to the Self-Service Portal (SSP).
    • The Full Access, Basic Access, and External Access roles cannot be changed because they are managed at the root OG (global level).
    • If these roles do not match your deployment requirements, you can create a custom role by clicking Add Role and configuring the required values.

Task 4: Add a Custom Administrator Role

You add a custom administrator role to your Workspace ONE UEM tenant.

  1. In the upper-right corner of the console, click the drop-down menu with your administrator name and verify that Student{labid} organization group is selected from the Organization Group drop-down menu.
  2. In the navigation pane at the top, select Accounts. Expand Administrators and click Admin Roles.
  3. Click Add Role.
  4. Enter Custom Device Manager {labid} in the Name text box.
  5. Enter Custom Device Manager Role for Help Desk in the Description text box.
  6. Configure the Device Management settings.
    1. In the left pane under Categories, select Device Management.
    2. The Read and Edit permissions appear in the right pane under Device Management.
  7. Under Device Management, select the Edit check box to enable "Edit" permission for all categories.
  8. Click Save.
  9. The custom Device Manager role is now listed in your OG.

Task 5: Add an Administrator and Assign Roles

You add an administrator account and assign the custom administrator role to it.

  1. n the navigation pane at the top, select Accounts. Expand Administrators and click Admins.
  2. From the Add drop-down menu, select Add Admin.
  3. Click Basic and click Next to configure a basic administrator and configure the following items.
OptionAction
UsernameEnter deviceadmin{labid} in the text box.
PasswordEnter Pa$$w0rd in the text box.
Confirm PasswordEnter Pa$$w0rd in the text box.
First NameEnter Device in the text box.
Last NameEnter Admin in the text box.
Email AddressEnter [email protected] in the text box.
Time ZoneLeave the default setting.
LocaleLeave the default setting.
Initial Landing PageLeave the default setting.

Each user name must be unique in this environment. The password must be alphanumeric and contain a minimum of six characters.

  1. Click Next to go to the Roles tab.
  2. Assign the new Custom Device Manager role that you created.
    1. Click in the Select Organization Group search box; type student, and select Student{labid}.
    2. Click in the Select Role search box, type custom, and select Custom Device Manager{labid}.
    3. Click Next and click Next again.
    4. Click Save.
    5. If a Warning window comes up, click Continue.

If saving the role fails, ensure that no other role is selected. You must also ensure that the password is at least six characters long and composed of letters and numbers.

The new administrator account is created with the Custom Device Manager role at your top-level OG. Applying customized administrative role assignments prevents administrators from interacting with the wrong environment or settings.

You are redirected back to the Administrator List View page.

Task 6: Review the Administrator User Management Settings

You review the administrator account management capabilities in the Workspace ONE UEM console.

  1. In the upper-right corner of the console, click the drop-down menu with your administrator name and verify that Student{labid} organization group is selected from the Organization Group drop-down menu.
  2. In the navigation pane at the top, select Accounts. Expand Administrators and click Admins.
  3. Click the vertical ellipsis button next to the administrator account user name.
  4. Review the controls used to implement key management features for ongoing maintenance and the upkeep of your administrator accounts.
    • Edit (pencil icon): Used to change administrator information to keep current contact information or privileges
    • Deactivate: Used to change the status of an administrator account from active to inactive.  With this control, you can temporarily suspend management features and privileges while maintaining the administrator account to use later.
    • Activate: Used to change the status of an administrator account from inactive to active.
    • Reset Password: Used to reset a compromised or forgotten password by an administrative user.  This setting only applies to a Basic administrator account
    • Login History: Displays a record of when administrators log in and out of the Workspace ONE UEM console.
    • Delete: Used to remove an account and revoke all console privileges.

Task 7: Log In with a new admin user and test role permissions

You log in to the Workspace ONE UEM console with the newly created administrator account.

  1. Open a new incognito window in Google Chrome.
  2. Enter https://omnissatraining.awmdm.com/AirWatch in the address bar to access the console page.
  3. Log in to the Workspace ONE UEM console with the new administrator account.
    • User name: deviceadmin{labid}
    • Password: Pa$$w0rd
  4. If prompted, read the Terms of Use and click Accept.
  5. Configure a Password Recovery question.
  6. From the Password Recovery Question drop-down menu, select a security question.
  7. Enter your answer in the Password Recovery Answer and Confirm Password Recovery Answer text boxes.
  8. Enter a 1234 in the Security PIN and Confirm Security PIN text boxes. Record this value for future use.
  9. Click Save.
  10. Review the controls in the navigation pane.

The controls are based on the roles that you assigned to this Workspace ONE UEM administrator account. You only have limited access to the navigation items because the new administrator account was only granted the Custom Device Manager admin privilege.

  1. Close the incognito window.

Task 8: Create an assignment group

You add assignment groups in your Workspace ONE UEM student tenant.

  1. In the upper-right corner of the console, click the drop-down menu with your administrator name and verify that Student{labid} organization group is selected from the Organization Group drop-down menu.

  2. In the navigation pane at the top, select Groups & Settings. Under Groups, select Assignment Groups.

  3. Click Add Smart Group.

  4. Enter Windows Desktop Devices in the Name text box.

  5. Leave Criteria selected next to Choose Type.

  6. Expand Platform and Operating System in the navigation pane.

  7. In the top-left drop-down menu, select Windows. Leave the default selections for the other drop-down menus.

  8. Expand Model Type in the navigation pane.

  9. Click Selected, and ensure that Windows - Desktop is the only option selected .

  10. Click Save.

  11. Click Add Smart Group.

  12. Enter Windows Server Devices in the Name text box.

  13. Leave Criteria selected next to Choose Type.

  14. Expand Platform and Operating System in the navigation pane.

  15. In the top-left drop-down menu, select Windows. Leave the default selections for the other drop-down menus.

  16. Expand Model Type in the navigation pane.

  17. Click Selected, and ensure that Windows - Server is the only option selected .

  18. Click Save.

  19. Click Add Smart Group.

  20. Enter Linux Devices in the Name text box.

  21. Expand Platform and Operating System in the navigation pane.

  22. In the top-left drop-down menu, select Linux. Leave the default selections for the other drop-down menus.

  23. Click Save.

  24. Click Add Smart Group.

  25. Enter Android Devices in the Name text box.

  26. Expand Platform and Operating System in the navigation pane.

  27. In the top-left drop-down menu, select Android. Leave the default selections for the other drop-down menus.

  28. Click Save.

  29. Click Add Smart Group.

  30. Enter iOS Devices in the Name text box.

  31. Expand Platform and Operating System in the navigation pane.

  32. In the top-left drop-down menu, select Apple iOS. Leave the default selections for the other drop-down menus.

  33. Click Save.

Task 9: Create an Organization Group

You create two lower-level organization groups (OGs).

  1. Log in to the ControlCenter VM.

    • User name: administrator

    • Password: Pa$$w0rd

  2. Open the Workspace ONE UEM administration console.

  3. On the ControlCenter Windows taskbar, click the Google Chrome icon.

  4. From the bookmarks bar, select Workspace ONE UEM.

    • You can also enter https://omnissatraining.awmdm.com/AirWatch in the address bar to access the console page.

  5. Log in to Workspace ONE UEM.

    • User name: studentadmin{labid}

    • Password: Pa$$w0rd

  6. In the navigation pane at the top, select Groups & Settings. Under Groups, select OG Details.

  7. Click the Add Child Organization Group tab and configure the settings for an OG called "Company Owned."

  8. Enter Company Owned in the Name text box.

  9. Enter companyowned{labid} in the Group ID text box.

  10. Verify that Container is selected from the Type drop-down menu. This is the default option.

  11. Configure the settings for country, locale, and time zone.

  12. Click Save.

  13. In the upper-right corner of the console, click the drop-down menu with your administrator name. Click the Organization Group drop-down menu and change Student{LabID}/Company Owned to Student{labid}.

  14. On the OG Details page, click Add Child Organization Group tab and configure the settings for an OG called Employee Owned.

  15. Enter Servers in the Name text box.

  16. Enter servers{labid} in the Group ID text box.

  17. Verify that Container is selected in the Type drop-down menu. This is the default option.

  18. Specify the country, locale, and time zone.

  19. Click Save.

  20. In the upper-right corner of the console, click the drop-down menu with your administrator name. Click the Organization Group drop-down menu and verify the OG structure.

    • Top-level OG: Student{labid}

    • Lower-level OG 1: Company Owned

    • Lower-level OG 2: Servers

Company Owned and Servers OGs would be parallel organization groups underneath the Top level OG.

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.