Skip to main content

​
Table of Contents

  1. Overview
  2. Prerequisites
  3. Deployment Workflow
  4. Step‑by‑Step Configuration
    1. Upload the Application
    2. Assign an SDK Profile (CRITICAL)
    3. Save & Assign
    4. Configure Launcher Layout (Optional)
    5. Enable App Data/Cache Clearing (Recommended)
    6. Set Excluded Package Names
    7. Lock Task Mode Setup (Critical for Kiosk)
    8. Device‑Side Permission Grant
    9. Updating the Application
  5. Troubleshooting
  6. Need Help?

​
Overview

OLOID DeviceLock MFA is an Android/iOS application that hardens device security with multi‑factor authentication and granular session controls. This guide walks Workspace ONE UEM administrators through publishing the SDK‑built app, establishing trust with the Omnissa SDK, and configuring launcher and kiosk settings so end‑users receive a secure, streamlined experience.

​
Prerequisites

Requirement Details Workspace ONE UEM Console access Admin role with rights to add internal apps and assign SDK profiles Signed application package .apk (Android) or .ipa (iOS) provided by OLOID SDK profile Use Workspace ONE default profile or a custom SDK profile that meets your organisation’s security policy Smart Groups Groups that represent the target devices/users (Android only) Device policy Allows Device Admin, Overlay, and Accessibility permissions

​
Deployment Workflow

  1. Upload the signed app to Resources → Native Apps → Internal.
  2. Assign an SDK profile to whitelist OLOID’s public signing key (establishes trust).
  3. Save & Assign the app to Smart Groups.
  4. (Optional) Adjust launcher layout so the icon is visible.
  5. (Recommended) Enable App Data/Cache Clearing for logout hygiene.
  6. Configure Excluded Package Names if needed.
  7. Enable Lock Task Mode for kiosk/pinned scenarios.
  8. On‑device: grant Device Admin, Overlay, and Accessibility permissions.
  9. Future updates: upload new APK/IPA → push to devices → reboot.

​
Step‑by‑Step Configuration

​
1. Upload the Application

  1. Log in to Workspace ONE UEM Console.
  2. Navigate to Resources › Native Apps › Internal and click Add Application.
  3. Browse to the signed .apk or .ipa, then Upload.
  4. Enter app metadata as required (version, description, icon).

​
2. Assign an SDK Profile (CRITICAL)

  1. In the newly added app, click Edit › More › SDK.
  2. Select the appropriate SDK Profile from the dropdown. Default profile is acceptable unless you have custom SDK settings.
  3. Save.
Why it matters: Workspace ONE extracts OLOID’s public signing key and whitelists it. When the user launches the app, Workspace ONE verifies this key to establish trust. Skipping this step causes installation failures or “untrusted app” errors.

​
3. Save & Assign

  1. Click Save & Assign.
  2. In the Assignment window:
    • Choose the Smart Groups (device/user cohorts).
    • Pick a Push Mode (Auto or On Demand).
  3. Click Add → Save & Publish.

​
4. Configure Launcher Layout (Optional)

  1. Go to Groups & Settings › Devices › Launcher › Layout.
  2. Add Section if needed, then add the OLOID app to the canvas.
  3. Position it for easy access and Save.
In the same launcher profile
  1. Locate Enable App Data/Cache Clearing.
  2. Set to Enabled → saves privacy by wiping data at logout.

​
6. Set Excluded Package Names

  1. Still in launcher settings, open Excluded Package Names.
Add any packages that must bypass launcher restrictions, e.g.:
  1. Save.

​
7. Lock Task Mode Setup (Critical for Kiosk)

  1. In the device profile, open Lock Task Mode.
  2. Allowlisted Apps → add OLOID DeviceLockMFA.
  3. (Optional) Add additional allowed apps.
  4. Configure buttons and system UIs: SettingSuggestedHome ButtonDisabledGlobal ActionsDisabledStatus‑bar system infoHiddenLock ScreenDefault (or customised)
  5. Save & Publish profile.

​
8. Device‑Side Permission Grant

After the profile pushes, instruct the user (or staging tech) to:
  1. Launch OLOID DeviceLock MFA – the app runs in admin‑mode.
  2. Grant the three Android permissions when prompted:
    1. Device Admin
    2. Display over other apps
    3. Accessibility The app supplies one‑tap links to each Settings page.
⚠️ All three permissions are mandatory; the app will loop on the setup screen until they are granted.

​
9. Updating the Application

  1. Upload the new signed APK/IPA to the same Internal app entry (increment version).
  2. Save & Publish to push to devices.
  3. Previously granted permissions persist—no re‑grant required.
  4. Instruct users to reboot once the update installs and re‑authenticate in Workspace ONE Launcher.

​
Troubleshooting

Symptom Likely Cause Resolution “Untrusted App” error SDK profile not assigned Verify step 2 – assign SDK profile and republish App not visible in launcher App not included in layout or wrong Smart Group Confirm launcher layout; verify group assignment & push mode App frozen on permission screen One or more permissions not granted Open Android Settings and enable Device Admin, Overlay, Accessibility Lock Task Mode isn’t enforced App not allow‑listed Add package to Allowlisted Apps and republish profile Post‑update crash APK signed with different key Re‑sign with original key or reinstall clean; then reboot Pinned‑mode instead of full kiosk Device boot inconsistency Reboot and relaunch via Workspace ONE Launcher Misc. crashes / policy conflicts Overlapping UEM policies Review other device profiles; collect logs for OLOID Support

​
Need Help?

If issues persist, collect device logs and screenshots, then contact OLOID Support at support@oloid.com or through your customer portal. Provide:
  • Workspace ONE console version
  • Device model & OS version
  • App version (Settings › About)
  • Steps to reproduce
With this information, our team can accelerate diagnosis and resolution.
Last updated: July 28 2025