> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oloid-demo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up OLOID DeviceLock  MFA

> Omnissa Workspace ONE UEM – Customer Action Guide

***

## Table of Contents

1. [Overview](#overview)
2. [Prerequisites](#prerequisites)
3. [Deployment Workflow](#deployment-workflow)
4. [Step‑by‑Step Configuration](#step-by-step-configuration)
   1. [Upload the Application](#1-upload-the-application)
   2. [Assign an SDK Profile **(CRITICAL)**](#2-assign-an-sdk-profile-critical)
   3. [Save & Assign](#3-save--assign)
   4. [Configure Launcher Layout (Optional)](#4-configure-launcher-layout-optional)
   5. [Enable App Data/Cache Clearing (Recommended)](#5-enable-app-datacache-clearing-recommended)
   6. [Set Excluded Package Names](#6-set-excluded-package-names)
   7. [Lock Task Mode Setup (Critical for Kiosk)](#7-lock-task-mode-setup-critical-for-kiosk)
   8. [Device‑Side Permission Grant](#8-device-side-permission-grant)
   9. [Updating the Application](#9-updating-the-application)
5. [Troubleshooting](#troubleshooting)
6. [Need Help?](#need-help)

***

## Overview

OLOID DeviceLock MFA is an Android/iOS application that hardens device security with multi‑factor authentication and granular session controls.
This guide walks Workspace ONE UEM administrators through publishing the SDK‑built app, establishing trust with the Omnissa SDK, and configuring launcher and kiosk settings so end‑users receive a secure, streamlined experience.

***

## Prerequisites

Requirement

Details

**Workspace ONE UEM Console access**

Admin role with rights to add internal apps and assign SDK profiles

**Signed application package**

`.apk` (Android) or `.ipa` (iOS) provided by OLOID

**SDK profile**

Use Workspace ONE default profile or a custom SDK profile that meets your organisation’s security policy

**Smart Groups**

Groups that represent the target devices/users

**(Android only) Device policy**

Allows Device Admin, Overlay, and Accessibility permissions

***

## Deployment Workflow

1. **Upload** the signed app to Resources → Native Apps → Internal.
2. **Assign an SDK profile** to whitelist OLOID’s public signing key (establishes trust).
3. **Save & Assign** the app to Smart Groups.
4. **(Optional)** Adjust **launcher layout** so the icon is visible.
5. **(Recommended)** Enable **App Data/Cache Clearing** for logout hygiene.
6. Configure **Excluded Package Names** if needed.
7. Enable **Lock Task Mode** for kiosk/pinned scenarios.
8. **On‑device**: grant Device Admin, Overlay, and Accessibility permissions.
9. **Future updates**: upload new APK/IPA → push to devices → reboot.

***

## Step‑by‑Step Configuration

## 1. Upload the Application

1. Log in to **Workspace ONE UEM Console**.
2. Navigate to **Resources › Native Apps › Internal** and click **Add Application**.
3. Browse to the signed `.apk` or `.ipa`, then **Upload**.
4. Enter app metadata as required (version, description, icon).

## 2. Assign an SDK Profile **(CRITICAL)**

1. In the newly added app, click **Edit › More › SDK**.
2. Select the appropriate **SDK Profile** from the dropdown.
   *Default profile* is acceptable unless you have custom SDK settings.
3. **Save**.

**Why it matters**: Workspace ONE extracts OLOID’s public signing key and whitelists it. When the user launches the app, Workspace ONE verifies this key to establish trust. Skipping this step causes installation failures or “untrusted app” errors.

## 3. Save & Assign

1. Click **Save & Assign**.
2. In the **Assignment** window:
   * Choose the **Smart Groups** (device/user cohorts).
   * Pick a **Push Mode** (Auto or On Demand).
3. Click **Add** → **Save & Publish**.

## 4. Configure Launcher Layout (Optional)

1. Go to **Groups & Settings › Devices › Launcher › Layout**.
2. **Add Section** if needed, then add the OLOID app to the canvas.
3. Position it for easy access and **Save**.

## 5. Enable App Data/Cache Clearing (Recommended)

*In the same launcher profile*

1. Locate **Enable App Data/Cache Clearing**.
2. Set to **Enabled** → saves privacy by wiping data at logout.

## 6. Set Excluded Package Names

1. Still in launcher settings, open **Excluded Package Names**.

Add any packages that must bypass launcher restrictions, e.g.:

```
com.oloid.devicelocklight
```

3. **Save**.

## 7. Lock Task Mode Setup (Critical for Kiosk)

1. In the device profile, open **Lock Task Mode**.
2. **Allowlisted Apps** → add `OLOID DeviceLockMFA`.
3. (Optional) Add additional allowed apps.
4. Configure buttons and system UIs:
   SettingSuggestedHome Button**Disabled**Global Actions**Disabled**Status‑bar system info**Hidden**Lock Screen**Default** (or customised)
5. **Save & Publish** profile.

## 8. Device‑Side Permission Grant

After the profile pushes, instruct the user (or staging tech) to:

1. Launch **OLOID DeviceLock MFA** – the app runs in admin‑mode.
2. Grant the three Android permissions when prompted:
   1. **Device Admin**
   2. **Display over other apps**
   3. **Accessibility**
      The app supplies one‑tap links to each Settings page.

⚠️ **All three permissions are mandatory**; the app will loop on the setup screen until they are granted.

## 9. Updating the Application

1. Upload the **new signed APK/IPA** to the same Internal app entry (increment version).
2. **Save & Publish** to push to devices.
3. Previously granted permissions persist—no re‑grant required.
4. Instruct users to **reboot** once the update installs and re‑authenticate in Workspace ONE Launcher.

***

## Troubleshooting

Symptom

Likely Cause

Resolution

**“Untrusted App” error**

SDK profile not assigned

Verify step 2 – assign SDK profile and republish

App not visible in launcher

App not included in layout or wrong Smart Group

Confirm launcher layout; verify group assignment & push mode

App frozen on permission screen

One or more permissions not granted

Open Android Settings and enable Device Admin, Overlay, Accessibility

Lock Task Mode isn’t enforced

App not allow‑listed

Add package to **Allowlisted Apps** and republish profile

Post‑update crash

APK signed with different key

Re‑sign with original key or reinstall clean; then reboot

Pinned‑mode instead of full kiosk

Device boot inconsistency

Reboot and relaunch via Workspace ONE Launcher

Misc. crashes / policy conflicts

Overlapping UEM policies

Review other device profiles; collect logs for OLOID Support

***

## Need Help?

If issues persist, collect device logs and screenshots, then contact **OLOID Support** at `support@oloid.com` or through your customer portal. Provide:

* Workspace ONE console version
* Device model & OS version
* App version (Settings › About)
* Steps to reproduce

With this information, our team can accelerate diagnosis and resolution.

***

*Last updated: July 28 2025*